CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

Showing 1–7 of 7 records

CVE Vendor Product Added Due Status
CVE-2020-15069 — Sophos XG Firewall Buffer Overflow Vulnerability
Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature.
 Sophos XG Firewall Feb 6, 2025 Feb 27, 2025
CVE-2020-29574 — CyberoamOS (CROS) SQL Injection Vulnerability
CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.
 Sophos CyberoamOS Feb 6, 2025 Feb 27, 2025 Ransomware
CVE-2023-1671 — Sophos Web Appliance Command Injection Vulnerability
Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.
 Sophos Web Appliance Nov 16, 2023 Dec 7, 2023
CVE-2022-3236 — Sophos Firewall Code Injection Vulnerability
A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.
 Sophos Firewall Sep 23, 2022 Oct 14, 2022
CVE-2022-1040 — Sophos Firewall Authentication Bypass Vulnerability
An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.
 Sophos Firewall Mar 31, 2022 Apr 21, 2022
CVE-2020-25223 — Sophos SG UTM Remote Code Execution Vulnerability
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.
 Sophos SG UTM Mar 25, 2022 Apr 15, 2022
CVE-2020-12271 — Sophos SFOS SQL Injection Vulnerability
Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).
 Sophos SFOS Nov 3, 2021 May 3, 2022 Ransomware
Ransomware Sophos

CVE-2020-12271 — Sophos SFOS SQL Injection Vulnerability

Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).

SFOS · Nov 3, 2021