Critical SQL Injection in Sophos SFOS (CVE‑2020‑12271) Enables Remote Code Execution & Credential Theft
What It Is – Sophos Firewall Operating System (SFOS) firmware contains an unauthenticated SQL‑injection flaw in the web‑admin interface and the User Portal when either service is exposed to the WAN. Successful exploitation can execute arbitrary code and dump local admin, portal‑admin and remote‑access user credentials (password hashes).
Exploitability – The vulnerability is publicly disclosed, has a published proof‑of‑concept, and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. CVSS v3.1 base score: 9.8 (Critical).
Affected Products – Sophos SFOS firmware (all versions prior to the vendor‑released patch, see Sophos advisory).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous configuration monitoring of admin‑exposed services; evidence of “admin interface not internet‑facing” is a core control that auditors request.
- Highlights gaps in credential protection – without proper segmentation and MFA, stolen hashes can be leveraged to bypass downstream controls.
- Provides a concrete example of why audit‑ready logging of admin‑portal access is essential for forensic readiness and to prove due‑diligence.
Recommended Actions
- Apply Sophos’s emergency patch for CVE‑2020‑12271 immediately.
- Restrict the administration (HTTPS) service and User Portal to trusted internal networks or VPN‑only access.
- Enforce multi‑factor authentication for all local and portal admin accounts.
- Enable and regularly review detailed access logs for admin‑portal activity; integrate logs into a SIEM for continuous monitoring.
- Conduct a configuration audit against the “admin interface exposure” control and capture evidence for audit trails.
Source: CISA KEV – CVE‑2020‑12271