Read the docs
TI-2020-12208 Aliases CVE-2020-15504GHSA-2hv5-x9f5-6mfx

A SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall…

Priority MEDIUM 46CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

A SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall v18.0 MR1 and older potentially allows an attacker to run arbitrary code remotely. The fix is built into the re-release of XG Firewall v18 MR-1 (named MR-1-Build396) and the v17.5 MR13 release. All other versions >= 17.0 have received a hotfix.

Why it matters now

EPSS 0.02159 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:o:sophos:xg_firewall_firmware:*:*:*:*:*:*:*:*17.0 – 17.5VulnerableSophos
cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release1:*:*:*:*:*:*17.5 maintenance_release1VulnerableSophos
cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release10:*:*:*:*:*:*17.5 maintenance_release10VulnerableSophos
cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release11:*:*:*:*:*:*17.5 maintenance_release11VulnerableSophos
cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release12:*:*:*:*:*:*17.5 maintenance_release12VulnerableSophos
cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release3:*:*:*:*:*:*17.5 maintenance_release3VulnerableSophos
cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release4:*:*:*:*:*:*17.5 maintenance_release4VulnerableSophos
cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release5:*:*:*:*:*:*17.5 maintenance_release5VulnerableSophos
cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release6:*:*:*:*:*:*17.5 maintenance_release6VulnerableSophos
cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release7:*:*:*:*:*:*17.5 maintenance_release7VulnerableSophos
  • cpe:2.3:o:sophos:xg_firewall_firmware:*:*:*:*:*:*:*:* Versions 17.0 – 17.5 Vulnerable ·Sophos
  • cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release1:*:*:*:*:*:* Versions 17.5 maintenance_release1 Vulnerable ·Sophos
  • cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release10:*:*:*:*:*:* Versions 17.5 maintenance_release10 Vulnerable ·Sophos
  • cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release11:*:*:*:*:*:* Versions 17.5 maintenance_release11 Vulnerable ·Sophos
  • cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release12:*:*:*:*:*:* Versions 17.5 maintenance_release12 Vulnerable ·Sophos
  • cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release3:*:*:*:*:*:* Versions 17.5 maintenance_release3 Vulnerable ·Sophos
  • cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release4:*:*:*:*:*:* Versions 17.5 maintenance_release4 Vulnerable ·Sophos
  • cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release5:*:*:*:*:*:* Versions 17.5 maintenance_release5 Vulnerable ·Sophos
  • cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release6:*:*:*:*:*:* Versions 17.5 maintenance_release6 Vulnerable ·Sophos
  • cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release7:*:*:*:*:*:* Versions 17.5 maintenance_release7 Vulnerable ·Sophos
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release8:*:*:*:*:*:*17.5 maintenance_release8VulnerableSophos
cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release9:*:*:*:*:*:*17.5 maintenance_release9VulnerableSophos
cpe:2.3:o:sophos:xg_firewall_firmware:18.0:-:*:*:*:*:*:*18.0VulnerableSophos
cpe:2.3:o:sophos:xg_firewall_firmware:18.0:maintenance_release1:*:*:*:*:*:*18.0 maintenance_release1VulnerableSophos
  • cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release8:*:*:*:*:*:* Versions 17.5 maintenance_release8 Vulnerable ·Sophos
  • cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release9:*:*:*:*:*:* Versions 17.5 maintenance_release9 Vulnerable ·Sophos
  • cpe:2.3:o:sophos:xg_firewall_firmware:18.0:-:*:*:*:*:*:* Versions 18.0 Vulnerable ·Sophos
  • cpe:2.3:o:sophos:xg_firewall_firmware:18.0:maintenance_release1:*:*:*:*:*:* Versions 18.0 maintenance_release1 Vulnerable ·Sophos

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15504
  2. 2026-10-03 Alias added: GHSA-2hv5-x9f5-6mfx

References

Advisory 1

  • TI-2020-11847 Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-13130 Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through… CVSS 3.1HIGH 8.8
  • TI-2022-03413 Code injection in Sophos Firewall CVSS 3.1HIGH 8.8
  • TI-2022-03410 Cross-site scripting in Sophos Firewall CVSS 3.1HIGH 8.4
  • TI-2022-02981 OS command injection in Sophos Firewall CVSS 3.1HIGH 7.2
  • TI-2022-03397 Code injection in Sophos Firewall CVSS 3.1HIGH 7.2
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences