CVE-2020-15504

Published: Jul 10, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall v18.0 MR1 and older potentially allows an attacker to run arbitrary code remotely. The fix is built into the re-release of XG Firewall v18 MR-1 (named MR-1-Build396) and the v17.5 MR13 release. All other versions >= 17.0 have received a hotfix.

Affected (14)

Products: Sophos: Xg Firewall Firmware

Sophos

1 product

Xg Firewall Firmware

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Sophos Xg Firewall Firmware	From 17.0 to 17.5
Sophos Xg Firewall Firmware	Version 17.5 maintenance_release10
Sophos Xg Firewall Firmware	Version 17.5 maintenance_release11
Sophos Xg Firewall Firmware	Version 17.5 maintenance_release12
Sophos Xg Firewall Firmware	Version 17.5 maintenance_release1
Sophos Xg Firewall Firmware	Version 17.5 maintenance_release3
Sophos Xg Firewall Firmware	Version 17.5 maintenance_release4
Sophos Xg Firewall Firmware	Version 17.5 maintenance_release5
Sophos Xg Firewall Firmware	Version 17.5 maintenance_release6
Sophos Xg Firewall Firmware	Version 17.5 maintenance_release7
Sophos Xg Firewall Firmware	Version 17.5 maintenance_release8
Sophos Xg Firewall Firmware	Version 17.5 maintenance_release9
Sophos Xg Firewall Firmware	Version 18.0
Sophos Xg Firewall Firmware	Version 18.0 maintenance_release1

Related CWEs

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (2)

https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-via-sqli-cve-2020-15504

Source: cve@mitre.org

Vendor Advisory

https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-via-sqli-cve-2020-15504

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.