Is CVE-2020-12271 actively exploited?

Yes. CVE-2020-12271 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2020-12271 be exploited remotely?

The attack vector of CVE-2020-12271 has not been classified yet.

What is the CVSS score of CVE-2020-12271?

CVE-2020-12271 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2020-12271

HIGHCISA KEVIN THE WILD

CVE-2020-12271

Published: November 3, 2021

EPSS:88.94%probability of exploitation in 30 daysPercentile:99.5th

Official Description

Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).

NVD Source

CISA KEV Advisory

Sophos SFOS SQL Injection Vulnerability

Added to KEV: 2021-11-03Federal patch deadline: 2022-05-03⚠ USED IN RANSOMWARE CAMPAIGNS

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

This vulnerability in Sophos Firewall (SFOS) allows for SQL injection when the administration or User Portal is exposed to the internet. Successful exploitation can lead to remote code execution and the theft of usernames and hashed passwords for local administrators and users. With an EPSS score of 0.88937 and confirmed exploitation in the wild, this is a critical vulnerability requiring immediate attention.

Active exploitation has been observed in the wild, and this vulnerability is included in CISA's KEV catalog, indicating confirmed exploitation. The flaw is remotely exploitable if the affected services are exposed on the WAN zone.

Recommended Action

Update Sophos Firewall operating system (SFOS) firmware to a patched version. Ensure that administrative interfaces and user portals are not directly exposed to the internet unless absolutely necessary, and implement strong access controls.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2020-12271 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2020-12271 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.