CVE-2024-12728 in Sophos
Summary
by MITRE • 12/19/2024
A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/12/2025
The vulnerability identified as CVE-2024-12728 represents a critical weak credentials issue affecting Sophos Firewall appliances running versions prior to 20.0 MR3. This weakness creates a pathway for unauthorized privileged access through the Secure Shell protocol, which is a fundamental administrative interface for network security devices. The vulnerability stems from the use of default or easily guessable credentials that remain unchanged after device deployment, creating an attack surface that adversaries can readily exploit without requiring advanced technical skills or specialized tools.
The technical flaw manifests in the authentication mechanism of the Sophos Firewall's SSH service, where default administrative accounts retain their initial passwords or use predictable credential combinations that do not meet modern security standards. This weakness falls under the CWE-798 category of using hardcoded credentials, and more specifically aligns with CWE-259 which addresses weak password policies and the reuse of default credentials. The vulnerability directly enables privilege escalation attacks as described in the MITRE ATT&CK framework under technique T1078 which covers valid accounts and T1566 which covers credential harvesting through various attack vectors.
Operational impact of this vulnerability extends beyond simple unauthorized access as it provides attackers with complete administrative control over the affected firewall appliance. This level of access enables threat actors to modify firewall rules, disable security features, redirect traffic, and potentially establish persistent backdoors within the network infrastructure. The attack surface becomes particularly dangerous when considering that firewall appliances typically serve as network perimeters, making successful exploitation a critical security incident that can compromise entire network segments. Organizations using affected versions face significant risk of data exfiltration, lateral movement, and disruption of network services.
Mitigation strategies should prioritize immediate remediation through firmware updates to Sophos Firewall version 20.0 MR3 or later, which addresses the weak credential issue through proper password generation and enforcement mechanisms. Network administrators must also implement comprehensive credential management policies including mandatory password changes, strong password requirements, and regular security audits. Additional protective measures include implementing SSH key-based authentication instead of password authentication, restricting SSH access to specific IP ranges, and deploying network segmentation to limit the potential impact of successful exploitation. The vulnerability also underscores the importance of continuous vulnerability assessment and the need for organizations to maintain current security patches across all network infrastructure components to prevent similar incidents.