{"id":"CVE-2020-15069","published":"2020-06-29T18:15:12Z","modified":"2026-06-17T02:55:59Z","title":"Sophos XG Firewall Buffer Overflow Vulnerability","vendor":"Sophos","product":"XG Firewall","tier":"core","eol":null,"description":{"text":"Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.","provenance":"source","from":"NVD"},"summary":{"text":"A buffer overflow in the HTTP/S Bookmarks feature for clientless access in Sophos XG Firewall, affecting versions 17.x through v17.5 MR12, allows remote code execution. An attacker with network access can exploit it without authentication, user interaction, or any special configuration beyond the affected feature being in use.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:24Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.10674,"percentile":0.95789,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2025-02-06","dueDate":"2025-02-27","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal ; https://nvd.nist.gov/vuln/detail/CVE-2020-15069","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-10-31","exploitedFirstSeen":"2024-10-31","ransomware":false,"evidence":[{"url":"https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/","date":"2024-10-31"},{"url":"https://news.sophos.com/en-us/2024/10/31/pacific-rim-timeline/","date":"2024-10-31"},{"url":"https://news.sophos.com/en-us/2024/10/31/pacific-rim-whats-it-to-you/","date":"2024-10-31"},{"url":"https://eclypsium.com/blog/salt-typhoon/","date":"2024-12-12"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-02-06"},{"url":"https://cyble.com/resources/research-reports/global-cybersecurity-report/","date":"2025-12-11"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-120","name":"Buffer Copy without Checking Size of Input"}],"references":[{"url":"https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal","tags":["Mitigation","Vendor Advisory"]},{"url":"https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15069","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote exploit of public-facing firewall web feature","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature","start":43,"end":126}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Buffer overflow yields remote code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows a Buffer Overflow and remote code execution","start":43,"end":93}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-7197","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7197","exploited":true,"exploitedSince":"2025-02-06","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2020-06-29","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15069","provenance":"source"},{"date":"2024-10-31","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/","provenance":"source"},{"date":"2025-02-06","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-02-06","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7197","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":1683},"priority":{"score":64.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 728 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.16,"detail":"percentile 0.9579"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}