Source: sophos · Limited verification•Last verified: •Collection Degraded
CVE-2020-15069ListedCRITICAL (raw)CVSS 9.8CWE-120
Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access
Published: 29 Jun 2020•Last updated: 17 Jun 2026, 08:25 AM IST•Source identifier: cve@mitre.org
Dossier completeness: source-provided sections 3 / 3 · rule guidance available. Missing source facts count as incomplete.
CISA KEV catalog
Listed
Added06 Feb 2025
Due27 Feb 2025
RansomwareUnknown
CVSS score
9.8CRITICAL (raw)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Metric sourcenvd@nist.gov
EPSS probability
10.7%0.107
Percentile96th
Weakness type
CWE-120
No further CWE recorded
Remediation
Patch status unknown
No fixed version or KB recorded
Why It Matters
Analysis dossierWhy It Matters
Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.
SOC priority
Immediate Attention
Actively exploited
Yes
Publicly disclosed
Unknown
Risk basis: CISA KEV exploitation signal; SOC ecosystem technology relevance; CRITICAL severity; Known exploitation signal from CISA KEV or ransomware metadata
Affected Products & Remediation
1 source-backed productAffected products and versions (source)
- sophos xg firewall firmware · >= 17.0 < 17.5; 17.5 · NVD CPE · Source
NVD applicability prerequisites: cpe:2.3:h:sophos:xg_firewall:-:*:*:*:*:*:*:*. These are conditions, not proof that an environment is exposed or unaffected.
Recorded patch / KBNot provided by source
Vendor or catalog guidance (source)
- CISA KEV: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known exploitation (source facts)
Only what a source states. Unknown means no source has said either way; it is not "not exploited".
- CISA KEV
- Listed
- Exploited (source statement)
- Yes
- Publicly disclosed (source)
- Unknown
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Suggested hunting (rule-based inference)
SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.
Matched kev-network-exposure (CVSS AV:N, CISA KEV Listed); network-unauthenticated (CVSS AV:N, CVSS PR:N, CVSS UI:N)
Exposure
- Identify assets with the exact CVE and confirm the affected product/version against the advisory.Telemetry: DeviceTvmSoftwareVulnerabilities · KEV listing raises urgency, but inventory is needed to establish local exposure. · Rule kev-network-exposure
- Identify devices reporting this CVE and note which expose the affected service to untrusted networks.Telemetry: DeviceTvmSoftwareVulnerabilities · A network-reachable, no-privilege vector makes internet-facing instances the first exposure question. · Rule network-unauthenticated
Exploitation evidence
- Review relevant edge or application access logs for unusual requests around the advisory window.Telemetry: CommonSecurityLog · Log review is a hunting hypothesis; KEV listing alone does not show local exploitation. · Rule kev-network-exposure
Show more (2)
Exploitation evidence
- Review inbound connections to the affected service from unexpected sources since the advisory date.Telemetry: DeviceNetworkEvents · Hunting hypothesis from the CVSS vector; it does not show that exploitation occurred. · Rule network-unauthenticated
Response
- Recheck the affected assets after the source-stated mitigation or update is applied.Telemetry: DeviceTvmSoftwareVulnerabilities · A follow-up inventory check verifies local remediation. · Rule kev-network-exposure
CISA KEV Record
Catalog entry
06 Feb 2025
Required action due
27 Feb 2025
Known ransomware use
Unknown
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Change History & Source Data
— No recorded material change
- CNA / source
- cve@mitre.org
- Record status · verification
- UPDATED · CISA KEV confirmed
- CPE
- cpe:2.3:o:sophos:xg_firewall_firmware:*:*:*:*:*:*:*:*, cpe:2.3:o:sophos:xg_firewall_firmware:17.5:-:*:*:*:*:*:*, cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release1:*:*:*:*:*:*, cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release10:*:*:*:*:*:*, cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release11:*:*:*:*:*:*, cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release12:*:*:*:*:*:*, cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release3:*:*:*:*:*:*, cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release4:*:*:*:*:*:*, cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release5:*:*:*:*:*:*, cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release6:*:*:*:*:*:*
Evidence & Provenance
Linked by the query's stored exact CVE association. Review required tables and validation status before use.
Detection Hunting Query
Target: DeviceTvmSoftwareVulnerabilities•Defender XDR
Detect endpoints exposed to CVE-2020-15069
Purpose: Exposure assessment (Category: Exposure Check)Why linked: Query metadata names CVE-2020-15069
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2020-15069"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel descSchema Checked · Not runtime validatedSource: SecOps Signal deterministic template · Limited verificationStatic screening: Passed structure and schema checks; tenant execution is not verified.
Loading related intelligence
Correlated briefings
SecOps Signal surfaces public advisory facts only. A missing value means the source has not published it, not that your environment is unaffected. No tenant inventory is connected.