CVE-2020-12271: Sophos SFOS SQL Injection Vulnerability

Sophos SFOS firmware contains a SQL injection vulnerability (CWE-89) that is triggered when either the administration HTTPS service or the User Portal is exposed on the WAN zone. Successful exploitation allows remote attackers to execute code remotely and extract sensitive credential data including usernames and hashed passwords for local device administrators, portal administrators, and remote access users. External directory service credentials such as Active Directory or LDAP passwords are not compromised by this vulnerability. This vulnerability has been observed in active exploitation scenarios and linked to ransomware campaigns.

Exploitation of this vulnerability can result in remote code execution on the affected Sophos SFOS device and unauthorized disclosure of sensitive credential information for local and portal administrators and remote access users. This can lead to further compromise of the firewall device and potentially the internal network it protects. External directory service credentials remain secure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict exposure of the administration HTTPS service and User Portal on the WAN zone to trusted networks only to reduce attack surface.