Critical · published December 19, 2024
🚨 A pre-auth SQL injection in Sophos Firewall could let attackers dive into your reporting database without even knocking! 🔥 Think of this as a sneaky delivery driver who gets access to your secure building just because someone left the side door open — they could steal all your data before you even realize they’re there! An attacker exploiting this vulnerability could not only read sensitive data but also run arbitrary code, leading to a catastrophic breach of your network. If your firewall is running in High Availability mode with SPX enabled, the risks multiply, turning a simple oversight into an absolute disaster!
Think of this as a sneaky delivery driver who gets access to your secure building just because someone left the side door open — they could steal all your data before you even realize they’re there! This SQL injection allows unauthenticated users to execute malicious queries against the firewall's reporting database, especially when SPX is configured in a certain way. It's a vulnerability that can open the floodgates to complete remote code execution.
An attacker exploiting this vulnerability could not only read sensitive data but also run arbitrary code, leading to a catastrophic breach of your network. If your firewall is running in High Availability mode with SPX enabled, the risks multiply, turning a simple oversight into an absolute disaster! Upgrade your Sophos Firewall to version 21.0.1 or later immediately. Review configurations related to the SPX feature and ensure that High Availability mode is secured. It's also wise to conduct a full audit of your firewall settings to ensure everything is locked down! You've got this! With these steps, you'll be reinforcing your defenses in no time! 🛡️