CVE-2024-12728

—1

CVSS 3.1

9.8 critical

EPSS

<1%p59

Published

Dec 19, 2024 (Dec 19, 2024)

Modified

Jun 17, 2026

Description

A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3).

Vendors: sophos
Products: firewall firmware
Weakness: CWE-1391
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news3 stories

⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips

The Hacker NewsDec 23, 12:14 UTC · Dec 23, 2024Ransomware CVE-2024-12727 CVE-2024-12728 CVE-2024-12729+23 CVEs1

60

Sophos fixed critical vulnerabilities in its Firewall product

Security AffairsDec 20, 21:23 UTC · Dec 20, 2024Vulnerability in the wildCVE-2024-12727 CVE-2024-12728 CVE-2024-12729+1 CVEs

60

Sophos Issues Hotfixes for Critical Firewall Flaws: Update to Prevent Exploitation

The Hacker NewsDec 20, 08:16 UTC · Dec 20, 2024Exploit / PoC in the wildCVE-2024-12727 CVE-2024-12728 CVE-2024-12729+1 CVEs

60