High severity8.8NVD Advisory· Published Aug 7, 2020· Updated Jun 17, 2026
CVE-2020-17352
CVE-2020-17352
Description
Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through 2020-08-05 potentially allow an authenticated attacker to remotely execute arbitrary code.
Affected products
16cpe:2.3:o:sophos:xg_firewall_firmware:17.5:-:*:*:*:*:*:*+ 13 more
- cpe:2.3:o:sophos:xg_firewall_firmware:17.5:-:*:*:*:*:*:*
- cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release10:*:*:*:*:*:*
- cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release11:*:*:*:*:*:*
- cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release12:*:*:*:*:*:*
- cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release1:*:*:*:*:*:*
- cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release3:*:*:*:*:*:*
- cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release4:*:*:*:*:*:*
- cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release5:*:*:*:*:*:*
- cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release6:*:*:*:*:*:*
- cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release7:*:*:*:*:*:*
- cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release8:*:*:*:*:*:*
- cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release9:*:*:*:*:*:*
- cpe:2.3:o:sophos:xg_firewall_firmware:18.0:-:*:*:*:*:*:*
- cpe:2.3:o:sophos:xg_firewall_firmware:18.0:mr1:*:*:*:*:*:*
- Sophos/XG Firewalldescription
- Range: <=2020-08-05
Patches
Vulnerability mechanics
References
2- community.sophos.com/b/security-blog/posts/advisory-resolved-authenticated-rce-issues-in-user-portal-cve-2020-17352nvdPatchVendor Advisory
- community.sophos.com/b/security-blognvdVendor Advisory
News mentions
0No linked articles in our index yet.