CVE-2020-12271: Sophos XG Firewall SFOS SQL Injection Leading to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated network exploitation, confirmed in-the-wild use, CISA KEV listing with known ransomware campaign use, and high EPSS score.

What it is

Sophos XG Firewall devices running SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 contain a SQL injection flaw in the administration (HTTPS) service or User Portal when exposed on the WAN zone. The flaw was exploited in the wild in April 2020 and can lead to remote code execution and exfiltration of local account usernames and hashed passwords.

Impact

An unauthenticated attacker can execute code on the firewall and steal usernames and hashed passwords for local device admins, portal admins, and remote-access user accounts. External Active Directory and LDAP passwords are not exposed by this flaw.

Attack surface

Reachable over the network via the WAN-exposed administration HTTPS service or User Portal; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Devices with those interfaces not exposed on the WAN are not affected.

Exploitation

Exploited in the wild in April 2020 and listed in CISA KEV with known ransomware campaign use; EPSS 30-day probability is about 0.42 (98.6th percentile), and references include an Exploit-tagged Sophos advisory.

What to do

• Apply the Sophos SFOS update that addresses CVE-2020-12271 as directed by the vendor advisory.
• Remove WAN exposure of the administration (HTTPS) service and User Portal; restrict access to trusted internal networks or VPN.
• Reset credentials for local device admins, portal admins, and remote-access user accounts, since hashed passwords may have been exfiltrated.
• Review firewall configuration and logs for unauthorized changes or persistence mechanisms, and rebuild if compromise is suspected.
• Monitor vendor and CISA guidance for follow-up indicators tied to this exploitation campaign.

Detection

• Hunt firewall and web logs for SQL injection patterns or anomalous requests to the admin HTTPS service and User Portal from WAN sources.
• Review authentication and admin activity logs for unexpected logins, new accounts, or configuration changes on XG Firewall devices.
• Check for outbound connections or data transfers from the firewall to unknown external hosts that could indicate exfiltration.
• Correlate with CISA KEV and vendor advisories for known indicators from the April 2020 exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.