Skip to content
NewA calmer, faster ZeroHour
Vulnerability4 · 1 read

CVE-2024-12727

CVSS 3.1
9.8 critical
EPSS
1%p71
Published
·
Modified
Analyze CVE-2024-12727 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange (SPX) is enabled in combination with the firewall running in High Availability (HA) mode.

Vendors
sophos
Products
firewall firmware
Weakness
CWE-89
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (1.4%)

In the news

3 stories