What’s Vulnerable › Vulnerabilities

CVE-2020-17352

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-08-07 · updated 2026-06-17
• Weakness: CWE-78

Description

Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through 2020-08-05 potentially allow an authenticated attacker to remotely execute arbitrary code.

Affected products

• Sophos Xg Firewall Firmware: 17.5, 17.5-maintenance_release1, 17.5-maintenance_release10, 17.5-maintenance_release11, 17.5-maintenance_release12, 17.5-maintenance_release3 (+8)

References

• https://community.sophos.com/b/security-blog
• https://community.sophos.com/b/security-blog/posts/advisory-resolved-authenticated-rce-issues-in-user-portal-cve-2020-17352
• https://community.sophos.com/b/security-blog
• https://community.sophos.com/b/security-blog/posts/advisory-resolved-authenticated-rce-issues-in-user-portal-cve-2020-17352

Get alerted when CVE-2020-17352 or the next vulnerability affects your stack