Description

CVE-2024-12728 is a critical vulnerability affecting older versions of Sophos Firewall (prior to 20.0 MR3) that allows potential unauthorized access to the system through SSH due to weak credentials. This vulnerability has an SVRS score of 10, indicating it is a highly critical threat requiring immediate action.

Key Insights

• Impact: Successful exploitation of this vulnerability grants attackers privileged access to the Sophos Firewall, enabling them to control the system and potentially access sensitive data or compromise other network resources.
• Severity: With a CVSS score of 9.8 and an SVRS score of 10, this vulnerability represents a serious threat. The impact is considered high due to the potential for attackers to gain complete control over the firewall.
• Affected Systems: This vulnerability affects older versions of Sophos Firewall prior to 20.0 MR3 (20.0.3). Users with older versions are urged to update to the latest version as soon as possible.
• Exploit Status: It's important to note that active exploits for this vulnerability have not been publicly reported at this time. However, the presence of a vulnerability with a high SVRS score indicates the potential for attackers to develop and deploy exploits.

Mitigation Strategies

• Update to the Latest Version: Immediately update your Sophos Firewall to version 20.0 MR3 or later. Updating will patch the vulnerability and protect your systems.
• Change Default Credentials: If possible, change the default SSH credentials for your firewall. Avoid using easily guessable passwords and opt for strong, complex credentials.
• Enable Two-Factor Authentication: Implement two-factor authentication for SSH access to your firewall, adding an extra layer of security and reducing the risk of unauthorized access.
• Network Segmentation: Segment your network to limit the potential impact of a compromise. Isolate the firewall from other critical systems to prevent attackers from spreading laterally within your network.

Additional Information

For users with specific questions or requiring more detailed information regarding this incident, the 'Ask to Analyst' feature can be utilized. Alternatively, users can reach out to SOCRadar directly or open a support ticket for further assistance.