CVE-2020-15069

Sophos XG Firewall Buffer Overflow Vulnerability

Sophos — XG Firewall

Added to KEV catalog: 6 February 2025
Federal remediation due date: 27 February 2025
Weakness classification (CWE): CWE-120

CISA Description

Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal ; https://nvd.nist.gov/vuln/detail/CVE-2020-15069

View on NVD View on MITRE CVE View full CISA catalog

More Sophos Vulnerabilities

CVE-2020-29574

CyberoamOS (CROS) SQL Injection Vulnerability

CVE-2023-1671

Sophos Web Appliance Command Injection Vulnerability

CVE-2022-3236

Sophos Firewall Code Injection Vulnerability

CVE-2022-1040

Sophos Firewall Authentication Bypass Vulnerability

CVE-2020-25223

Sophos SG UTM Remote Code Execution Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services