CVE-2020-15069
Sophos XG Firewall Buffer Overflow Vulnerability
Description
CVE-2020-15069 is a critical buffer overflow vulnerability in Sophos XG Firewall versions 17.x through v17.5 MR12 that allows unauthenticated remote code execution via the HTTP/S Bookmarks feature for clientless access. With a CVSS v3.1 base score of 9.8 and an EPSS score of 82.58% at the 99th percentile, this vulnerability is among the most critical and actively exploited firewall vulnerabilities tracked. CISA has added CVE-2020-15069 to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 27, 2025, underscoring that threat actors continue to target unpatched Sophos firewalls years after the initial disclosure and hotfix release in 2020.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sophos | xg firewall firmware | >= 17.0, < 17.5; 17.5 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15069(US Government Resource)
Weakness Type
Buffer Overflow in HTTP/S Bookmarks Feature
CVE-2020-15069 is a buffer overflow vulnerability in the HTTP/S Bookmarks feature of Sophos XG Firewall. While no specific CWE has been formally assigned, the vulnerability is characteristic of classic buffer overflow weaknesses where input data exceeds the allocated buffer size, causing adjacent memory to be overwritten. The HTTP/S Bookmarks feature, used for clientless remote access through the XG Firewall's user portal, fails to properly validate the length of input data, allowing an attacker to send specially crafted requests that overflow a buffer and overwrite critical memory structures, ultimately achieving arbitrary code execution on the firewall appliance.
Impact Analysis
CVE-2020-15069 poses an extreme risk to organizations using affected Sophos XG Firewall versions. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) represents the most dangerous combination: network-exploitable, low complexity, no authentication required, and no user interaction needed, with maximum impact across all three security dimensions. Confidentiality (High): Arbitrary code execution on a network firewall grants the attacker access to all traffic passing through the device, including encrypted traffic that may be terminated at the firewall. The attacker can capture credentials, session tokens, email contents, and sensitive business data flowing through the network perimeter. Integrity (High): Complete control of the firewall allows an attacker to modify firewall rules to permit unauthorized access, redirect traffic, inject malicious content into unencrypted network streams, install persistent backdoors, and disable security logging to cover their tracks. Availability (High): The attacker can disrupt all network connectivity by crashing the firewall, modifying routing configurations, or selectively blocking traffic to cause denial of service for the entire protected network. The EPSS score of 82.58% at the 99th percentile confirms near-certain exploitation activity. Ransomware association is currently listed as unknown, but compromised network firewalls provide attackers with an ideal position to deploy ransomware across the entire protected network.
Exploit Maturity
CVE-2020-15069 demonstrates maximum exploit maturity with confirmed active exploitation over an extended period. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, confirming continued active exploitation with a mandatory remediation deadline of February 27, 2025 — nearly five years after the initial disclosure. Sophos released Hotfix HF062020.1 in 2020, and mitigation guidance is available through the Sophos security blog. The EPSS score of 82.58% at the 99th percentile places this among the most actively exploited vulnerabilities currently tracked. The long time since disclosure, combined with continued active exploitation, indicates that a significant population of unpatched Sophos XG Firewalls remains accessible on the internet. Sophos firewall vulnerabilities have been extensively targeted by advanced persistent threat groups, particularly Chinese state-sponsored actors, as documented in multiple threat intelligence reports. The ability to compromise a perimeter firewall without authentication makes this an extremely high-value target. Ransomware association is currently listed as unknown.
Remediation
-
Apply the Sophos hotfix or upgrade firmware immediately. Sophos released Hotfix HF062020.1 for all firewalls running v17.x to address CVE-2020-15069. If the hotfix has not been applied, install it immediately. Better yet, upgrade to a current, fully supported firmware version that includes all security fixes. Consult the Sophos security advisory for specific hotfix and upgrade details.
-
Disable the HTTP/S Bookmarks feature if not required. The vulnerability exists in the HTTP/S Bookmarks feature for clientless access within the user portal. If this feature is not actively used by your organization, disable it to eliminate the attack surface entirely while planning firmware updates.
-
Restrict access to the user portal. Implement access control rules that limit access to the Sophos XG Firewall user portal and its clientless access features from trusted networks only. Block public internet access to the user portal to reduce exposure to remote exploitation attempts.
-
Conduct a forensic review of affected firewalls. Given the long history of active exploitation, review firewall logs, configuration changes, and running processes for indicators of compromise. Check for unauthorized firewall rules, unexpected VPN accounts, modified system files, and anomalous outbound connections that could indicate prior compromise.
-
Implement a firewall lifecycle management program. Ensure all network security appliances are included in regular patch management cycles with defined SLAs for critical vulnerability remediation. Subscribe to Sophos security advisories and CISA alerts for timely notification of future vulnerabilities. Consider deploying automated vulnerability scanning that includes network appliances in its scope.
Technical Details
CVE-2020-15069 is a buffer overflow vulnerability in the HTTP/S Bookmarks feature of Sophos XG Firewall. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the maximum severity profile: the vulnerability is network-exploitable without authentication or user interaction, with complete impact on confidentiality, integrity, and availability. The HTTP/S Bookmarks feature is part of the clientless access functionality in the Sophos XG Firewall user portal, which allows authenticated users to access internal web resources through the firewall without requiring a VPN client. The vulnerability exists in the processing of requests to this feature, where input data is copied into a fixed-size buffer without adequate length validation. When a specially crafted request exceeds the buffer boundary, the overflow corrupts adjacent memory regions, including function pointers, return addresses, or other control structures. An attacker can carefully construct the overflow payload to redirect execution flow to attacker-controlled code, achieving arbitrary code execution with the privileges of the firewall process. Since the firewall process runs with elevated system privileges on the Sophos XG appliance, successful exploitation grants the attacker full control over the firewall operating system. The affected versions include all Sophos XG Firewall firmware versions from 17.0 through 17.5 MR12. Sophos addressed the vulnerability with Hotfix HF062020.1, which was published for all firewalls running v17.x.
Frequently Asked Questions
Is CVE-2020-15069 still being actively exploited?
Yes. Despite being disclosed in 2020, CISA added CVE-2020-15069 to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 27, 2025, confirming continued active exploitation. The EPSS score of 82.58% at the 99th percentile indicates near-certain exploitation activity against unpatched Sophos XG Firewalls.
What Sophos products are affected by CVE-2020-15069?
CVE-2020-15069 affects Sophos XG Firewall versions 17.x through v17.5 MR12. The vulnerability specifically targets the HTTP/S Bookmarks feature used for clientless access through the user portal. Sophos released Hotfix HF062020.1 to address the issue.
How do I fix CVE-2020-15069?
Apply Sophos Hotfix HF062020.1 or upgrade to a current firmware version. If the HTTP/S Bookmarks feature is not required, disable it to eliminate the attack surface. Restrict public access to the user portal as an additional defensive measure.
Can CVE-2020-15069 be exploited without authentication?
Yes. The vulnerability has a CVSS v3.1 base score of 9.8 and requires no authentication (PR:N) and no user interaction (UI:N) to exploit. An attacker only needs network access to the XG Firewall user portal's HTTP/S Bookmarks feature to trigger the buffer overflow and achieve remote code execution.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.