CVE-2020-15504

Name of the Vulnerable Software and Affected Versions Sophos XG Firewall versions prior to 18.0 MR-1-Build396 Sophos XG Firewall versions prior to 17.5 MR13

Description A SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall potentially allows an attacker to run arbitrary code remotely.

Recommendations For Sophos XG Firewall versions prior to 18.0 MR-1-Build396, update to the re-release of XG Firewall v18 MR-1 (named MR-1-Build396). For Sophos XG Firewall versions prior to 17.5 MR13, update to the v17.5 MR13 release. For all other versions >= 17.0, apply the received hotfix.