Sophos Firewall Vulnerabilities Patched: A Must-Know for Organizations

Recent updates from Sophos have revealed critical vulnerabilities in their Firewall versions 21.0 GA and older, affecting nearly a percentage of the installed base. These vulnerabilities, if exploited, could lead to severe security breaches including remote code execution and account exposure. Here’s what you need to know.

Understanding the Vulnerabilities

Three significant vulnerabilities have been identified and addressed in the latest hotfixes.

CVE-2024-12727: Critical Pre-Auth SQL Injection Bug

This vulnerability allows attackers to perform SQL injection without needing to authenticate. Sophos estimates that nearly 0.05% of firewalls could be affected. Exploiting this bug could permit full control over the firewall system.

CVE-2024-12728: Critical Weak Credentials Flaw

A more prevalent issue, affecting almost 0.5% of firewalls, is a weak credentials flaw. Unauthorized users could exploit this to gain elevated access, posing significant security risks.

CVE-2024-12729: High-Severity Post-Auth Code Injection Issue

This vulnerability allows attackers to inject code after they have authenticated on the system. The potential for remote code execution increases the severity of this flaw.

Steps to Protect Your Systems

To safeguard against these vulnerabilities, Sophos has provided specific instructions for applying the hotfixes.

Applying Hotfix CVE-2024-12727

To address the SQL injection bug, execute cat /conf/nest_hotfix_status from the Advanced Shell of the firewall console.

Applying Hotfixes CVE-2024-12728 and CVE-2024-12729

For the weak credentials flaw and post-auth code injection issue, perform system diagnostic show version-info.

Additional Security Measures

Beyond applying the hotfixes, organizations should implement additional security protocols to mitigate risks.

Limit SSH Access

Restricting SSH access can prevent unauthorized users from accessing the firewall’s management interface.

Reconfigure High Availability Clusters

High Availability (HA) clusters should be reconfigured to reduce the risk of coordinated attacks.

Isolate User Portal and Webadmin from WAN

Disabling WAN access through SSH and isolating the User Portal and Webadmin can significantly enhance security.

The Importance of Proactive Security Measures

With the increasing sophistication of cyber threats, it is crucial for organizations to remain vigilant and proactive. The vulnerabilities addressed in this patch are indicative of the evolving nature of cybersecurity threats.

By staying informed and implementing the necessary hotfixes and security protocols, organizations can better protect their systems from exploitation.

Conclusion

The recent vulnerabilities in Sophos Firewall serve as a reminder of the importance of regular software updates and robust security practices. By promptly updating firewalls and implementing strong security measures, organizations can significantly reduce the risk of cyber attacks.

If you manage IT systems for your organization, ensure your Sophos Firewall is updated to the latest version to safeguard against these critical vulnerabilities.

Stay informed about the latest developments in cybersecurity to protect your networks and data.

Don’t forget to comment below with your thoughts or questions about this vulnerability. Also, consider subscribing to Archynetys to receive the latest news and updates directly to your inbox!