CVE-2020-15069: Sophos XG Firewall buffer overflow in HTTP/S Bookmarks

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, remote code execution on an internet-facing perimeter device, and confirmed inclusion in CISA KEV.

What it is

Sophos XG Firewall 17.x through v17.5 MR12 contains a classic buffer overflow (CWE-120) reachable through the HTTP/S Bookmarks feature used for clientless access. Successful exploitation allows remote code execution on the firewall. Because the firewall is an internet-facing security device, compromise can expose the entire protected network.

Impact

An unauthenticated remote attacker can execute arbitrary code on the firewall, gaining control of a perimeter device that sits in front of internal networks and VPN access.

Attack surface

Reached over the network through the HTTP/S Bookmarks clientless access feature; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.

Exploitation

Listed in CISA KEV (added 2025-02-06, due 2025-02-27) with a required action to apply vendor mitigations or discontinue use, indicating known exploitation. EPSS 30-day probability is 0.10674 (95.57th percentile); no ransomware campaign use is recorded.

What to do

• Apply the vendor hotfix HF062020.1 or a later fixed firmware release for XG Firewall v17.x; if a fixed release is unavailable, follow Sophos instructions or discontinue use per CISA guidance.
• Restrict or disable the HTTP/S Bookmarks clientless access feature if it is not required.
• Limit exposure of the firewall user portal and management interfaces to trusted networks rather than the public internet.
• Monitor Sophos advisories and CISA KEV for updated remediation guidance and deadlines.
• Review firewall and portal logs for signs of compromise and rotate credentials if exploitation is suspected.

Detection

• Inspect HTTP/S Bookmarks requests to the user portal for oversized or malformed parameters that could trigger the buffer overflow.
• Monitor firewall processes for unexpected crashes, restarts, or abnormal child processes.
• Hunt for unusual outbound connections or new listening services originating from the firewall itself.
• Correlate firewall logs with CISA KEV remediation tracking to confirm patched firmware versions across the estate.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.