{"id":"CVE-2020-15069","published":"2020-06-29T18:15:12Z","modified":"2026-06-17T02:55:59Z","title":"Sophos XG Firewall Buffer Overflow Vulnerability","vendor":"Sophos","product":"XG Firewall","tier":"core","eol":null,"description":{"text":"Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.","provenance":"source","from":"NVD"},"summary":{"text":"A buffer overflow in the HTTP/S Bookmarks feature for clientless access in Sophos XG Firewall, affecting versions 17.x through v17.5 MR12, allows remote code execution. An attacker with network access can exploit it without authentication, user interaction, or any special configuration beyond the affected feature being in use.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:24Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.10674,"percentile":0.95806,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2025-02-06","dueDate":"2025-02-27","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal ; https://nvd.nist.gov/vuln/detail/CVE-2020-15069","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-10-31","exploitedFirstSeen":"2024-10-31","ransomware":false,"evidence":[{"url":"https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/","date":"2024-10-31"},{"url":"https://news.sophos.com/en-us/2024/10/31/pacific-rim-timeline/","date":"2024-10-31"},{"url":"https://news.sophos.com/en-us/2024/10/31/pacific-rim-whats-it-to-you/","date":"2024-10-31"},{"url":"https://eclypsium.com/blog/salt-typhoon/","date":"2024-12-12"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-02-06"},{"url":"https://cyble.com/resources/research-reports/global-cybersecurity-report/","date":"2025-12-11"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-120","name":"Buffer Copy without Checking Size of Input"}],"references":[{"url":"https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal","tags":["Mitigation","Vendor Advisory"]},{"url":"https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15069","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote exploit of public-facing firewall web feature","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature","start":43,"end":126}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Buffer overflow yields remote code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows a Buffer Overflow and remote code execution","start":43,"end":93}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-7197","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7197","exploited":true,"exploitedSince":"2025-02-06","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2020-06-29","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15069","provenance":"source"},{"date":"2024-10-31","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/","provenance":"source"},{"date":"2025-02-06","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-02-06","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7197","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":1683},"priority":{"score":61.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 731 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.16,"detail":"percentile 0.9581"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}