Command injection

2020-08-0720:15:00

PRIOn knowledge base

www.prio-n.com

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.8%

JSON

Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through 2020-08-05 potentially allow an authenticated attacker to remotely execute arbitrary code.

CPENameOperatorVersion
xg_firewall_firmwareeq17.5
xg_firewall_firmwareeq17.5 maintenance-release12
xg_firewall_firmwareeq17.5 maintenance-release11
xg_firewall_firmwareeq17.5 maintenance-release10
xg_firewall_firmwareeq17.5 maintenance-release9
xg_firewall_firmwareeq17.5 maintenance-release8
xg_firewall_firmwareeq17.5 maintenance-release7
xg_firewall_firmwareeq17.5 maintenance-release6
xg_firewall_firmwareeq17.5 maintenance-release5
xg_firewall_firmwareeq17.5 maintenance-release4

Name	Operator	Version
xg_firewall_firmware	eq	17.5
xg_firewall_firmware	eq	17.5 maintenance-release12
xg_firewall_firmware	eq	17.5 maintenance-release11
xg_firewall_firmware	eq	17.5 maintenance-release10
xg_firewall_firmware	eq	17.5 maintenance-release9
xg_firewall_firmware	eq	17.5 maintenance-release8
xg_firewall_firmware	eq	17.5 maintenance-release7
xg_firewall_firmware	eq	17.5 maintenance-release6
xg_firewall_firmware	eq	17.5 maintenance-release5
xg_firewall_firmware	eq	17.5 maintenance-release4