CVE-2020-15069

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 10,7%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada sophos xg firewall firmware. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 6 Februari 2025, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.

Rincian

Terbit di NVD

29 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

10,7% peluang dieksploitasi; lebih tinggi dari 95,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Sophos XG Firewall Buffer Overflow Vulnerability

Masuk KEV

6 Februari 2025

Tenggat CISA

27 Februari 2025 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal mitigasi · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15069 pemerintah AS