CVE-2020-12271
Sophos SFOS SQL Injection Vulnerability
Description
CVE-2020-12271 is a critical SQL injection vulnerability in Sophos XG Firewall operating system (SFOS). The vulnerability exists in SFOS versions 17.0, 17.1, 17.5, and 18.0 when either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation allows a remote unauthenticated attacker to execute code and exfiltrate usernames and hashed passwords for local device administrators, portal admins, and remote access user accounts. CISA has confirmed active exploitation of CVE-2020-12271 and has linked it to ransomware campaigns. The EPSS score of 88.9% (99.5th percentile) signals near-certain exploitation, underscoring the urgent need for patching affected Sophos firewall devices.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sophos | sfos | 17.0; 17.1; 17.5; 18.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://community.sophos.com/kb/en-us/135412(Vendor Advisory)
- https://cwe.mitre.org/data/definitions/89.html(Third Party Advisory)
- https://news.sophos.com/en-us/2020/04/26/asnarok/(Exploit, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-12271(US Government Resource)
Weakness Type
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
SQL Injection occurs when user-supplied input is incorporated into database queries without proper sanitization. In the Sophos SFOS vulnerability, attackers can inject malicious SQL statements through the WAN-exposed administration or User Portal interfaces, enabling remote code execution and the extraction of stored credentials from the firewall’s database.
Learn more: CWE-89 — Improper Neutralization of Special Elements used in an SQL Command
Impact Analysis
CVE-2020-12271 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting maximum-severity risk. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and requires no user interaction, making it straightforward for attackers to leverage. Successful exploitation compromises confidentiality through credential theft, integrity through potential code execution, and availability of the affected Sophos XG Firewall. The EPSS score of 88.9% indicates near-certain exploitation activity in the wild. This vulnerability is also known to be associated with ransomware campaigns, greatly amplifying the business impact for organizations relying on Sophos firewalls as their primary network perimeter defense.
Exploit Maturity
CVE-2020-12271 was actively exploited in the wild in April 2020 in what Sophos documented as the "Asnarok" attack campaign. Public exploit code is available via Sophos’s detailed technical analysis. CISA has confirmed active exploitation by adding the vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of 2022-05-03, and the vulnerability is known to be associated with ransomware operations. The EPSS score of 88.9% (99.5th percentile) indicates a very high probability of exploitation, placing this among the most actively targeted firewall vulnerabilities.
Remediation
- Apply updates per vendor instructions as mandated by CISA KEV. Upgrade Sophos SFOS to a patched version released after April 25, 2020, which addresses the SQL injection vulnerability.
- Verify that all Sophos XG Firewall devices running SFOS versions 17.0, 17.1, 17.5, or 18.0 have been updated to the latest available firmware.
- If the administration (HTTPS) service or User Portal was exposed on the WAN zone, immediately reset all local administrator passwords, portal admin passwords, and remote access user credentials, as these may have been exfiltrated.
- Restrict WAN-zone access to the firewall management interface and User Portal by implementing IP-based access controls, and enable multi-factor authentication where supported.
- Review firewall logs for indicators of compromise consistent with SQL injection attacks, including unusual database queries, unauthorized login attempts, and evidence of the Asnarok trojan or related malware.
Technical Details
CVE-2020-12271 is a SQL injection vulnerability in Sophos SFOS affecting versions 17.0, 17.1, 17.5, and 18.0. The flaw is triggered when either the HTTPS-based administration service or the User Portal is accessible from the WAN zone. An attacker sends crafted requests containing SQL injection payloads to these interfaces, which the application processes without adequate input validation or parameterized queries. The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms the attack is fully network-based, trivially exploitable, and has maximum impact across all three security domains. The exploit chain allows attackers to not only extract credentials but also achieve remote code execution on the firewall, enabling post-exploitation activities such as deploying additional malware or pivoting into protected network segments.
Frequently Asked Questions
Is CVE-2020-12271 being actively exploited?
Yes. CVE-2020-12271 was actively exploited in the wild during the Asnarok attack campaign in April 2020. CISA has confirmed active exploitation and the vulnerability is associated with ransomware campaigns. The EPSS score of 88.9% (99.5th percentile) indicates a very high probability of continued exploitation.
What products are affected by CVE-2020-12271?
CVE-2020-12271 affects Sophos XG Firewall devices running SFOS versions 17.0, 17.1, 17.5, and 18.0 prior to the April 25, 2020 hotfix. Devices are vulnerable when the administration (HTTPS) service or User Portal is exposed on the WAN zone.
How do I fix CVE-2020-12271?
Upgrade Sophos SFOS to the latest patched firmware version. After patching, reset all local admin, portal admin, and remote access user credentials. Restrict WAN-zone access to the management interface and User Portal, and enable multi-factor authentication.
How severe is CVE-2020-12271?
CVE-2020-12271 has a CVSS 3.1 score of 9.8 (CRITICAL) and an EPSS score of 88.9% (99.5th percentile). It is remotely exploitable without authentication and has been used in ransomware campaigns, making it an extremely high-priority vulnerability for organizations using Sophos XG Firewalls.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.