TI-2020-09226 Aliases CVE-2020-11503 GHSA-m76g-2f52-hcj3

A heap-based buffer overflow in the awarrensmtp component of Sophos XG Firewall v17.5…

MEDIUM 45CWE-787Published 2020-06-18 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

A heap-based buffer overflow in the awarrensmtp component of Sophos XG Firewall v17.5 MR11 and older potentially allows an attacker to run arbitrary code remotely.

Why it matters now

EPSS 0.01444 73rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 14

CPE	Versions	Role	Vendor
cpe:2.3:o:sophos:sfos::::::::	before 17.5	Vulnerable	Sophos
cpe:2.3:o:sophos:sfos:17.5:-::::::	17.5	Vulnerable	Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release1::::::	17.5 maintenance_release1	Vulnerable	Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release10::::::	17.5 maintenance_release10	Vulnerable	Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release11::::::	17.5 maintenance_release11	Vulnerable	Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release2::::::	17.5 maintenance_release2	Vulnerable	Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release3::::::	17.5 maintenance_release3	Vulnerable	Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release4::::::	17.5 maintenance_release4	Vulnerable	Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release5::::::	17.5 maintenance_release5	Vulnerable	Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release6::::::	17.5 maintenance_release6	Vulnerable	Sophos

cpe:2.3:o:sophos:sfos:*:*:*:*:*:*:*:* Versions before 17.5 Vulnerable ·Sophos
cpe:2.3:o:sophos:sfos:17.5:-:*:*:*:*:*:* Versions 17.5 Vulnerable ·Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release1:*:*:*:*:*:* Versions 17.5 maintenance_release1 Vulnerable ·Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release10:*:*:*:*:*:* Versions 17.5 maintenance_release10 Vulnerable ·Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release11:*:*:*:*:*:* Versions 17.5 maintenance_release11 Vulnerable ·Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release2:*:*:*:*:*:* Versions 17.5 maintenance_release2 Vulnerable ·Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release3:*:*:*:*:*:* Versions 17.5 maintenance_release3 Vulnerable ·Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release4:*:*:*:*:*:* Versions 17.5 maintenance_release4 Vulnerable ·Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release5:*:*:*:*:*:* Versions 17.5 maintenance_release5 Vulnerable ·Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release6:*:*:*:*:*:* Versions 17.5 maintenance_release6 Vulnerable ·Sophos

Show 4 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:sophos:sfos:17.5:maintenance_release7::::::	17.5 maintenance_release7	Vulnerable	Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release8::::::	17.5 maintenance_release8	Vulnerable	Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release9::::::	17.5 maintenance_release9	Vulnerable	Sophos
cpe:2.3:h:sophos:xg_firewall:-:::::::*	not specified by NVD	Running on	Sophos

cpe:2.3:o:sophos:sfos:17.5:maintenance_release7:*:*:*:*:*:* Versions 17.5 maintenance_release7 Vulnerable ·Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release8:*:*:*:*:*:* Versions 17.5 maintenance_release8 Vulnerable ·Sophos
cpe:2.3:o:sophos:sfos:17.5:maintenance_release9:*:*:*:*:*:* Versions 17.5 maintenance_release9 Vulnerable ·Sophos
cpe:2.3:h:sophos:xg_firewall:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sophos

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-11503
2026-10-03 Alias added: GHSA-m76g-2f52-hcj3

References

Advisory 1

https://community.sophos.com/b/security-blog/posts/advisory-potential-rce-through-heap-overflow-in-awarrensmtp-cve-2020-11503

TI-2022-00937 An authentication bypass vulnerability in the User Portal and Webadmin allows a remote… KEVCVSS 3.1CRITICAL 9.8
TI-2020-09803 A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on… KEVCVSS 3.1CRITICAL 9.8
TI-2018-11527 A shell escape vulnerability in /webconsole/Controller in Admin Portal of Sophos XG… CVSS 3.1HIGH 8.8
TI-2018-11528 A shell escape vulnerability in /webconsole/APIController in the API Configuration… CVSS 3.0HIGH 8.1
TI-2018-11526 SQL injection vulnerability in AccountStatus.jsp in Admin Portal of Sophos XG firewall… CVSS 3.0HIGH 8.8
TI-2017-13223 An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS… CVSS 3.0MEDIUM 6.1

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences