DaystoPatch

SophosExploited incident

Sophos XG Firewall v17.x User Portal bookmark buffer overflow (2020)

CVE-2020-15069Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 6 Feb 2025

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Sophos security advisory sophos-sa-20200625-xg-user-portal-rceCuratedQuote verified

    This was a previously unknown buffer overflow vulnerability in the user portal HTTP/S bookmark feature.

    Advisory header: 'First Published 2020 Jun 25'. No earlier public report was found.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:42f2966de5e22c9d…
    Used in metrics
    Yes
    Dispute this timestamp
    3 more sources for this moment
    CVE.org record CVE-2020-15069ClaimedQuote verified29 Jun 2020, 17:30 UTC

    Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:bb8889f081351945…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2020-15069)ClaimedQuote verified6 Feb 2025

    Sophos XG Firewall Buffer Overflow Vulnerability

    Added to CISA's KEV catalog on 2025-02-06.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet7 Feb 2025, 21:01 UTC

    CVE-2020-15069 has confirmed exploit code according to the following sources: CISA KEV, Vulncheck KEV.

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Sophos security advisory sophos-sa-20200625-xg-user-portal-rceCuratedQuote verified

    sophos-sa-20200625-xg-user-portal-rce

    Publication ID encodes the date; header shows 'First Published 2020 Jun 25'.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:42f2966de5e22c9d…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Sophos security advisory sophos-sa-20200625-xg-user-portal-rceCuratedQuote verified

    Hotfix HF062020.1 was published for all firewalls running v17.x

    The hotfix may have been pushed (automatic hotfix installation) before the advisory; its exact release date was not found.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:42f2966de5e22c9d…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Sophos security advisory sophos-sa-20200625-xg-user-portal-rceCuratedQuote verified

    Hotfix HF062020.1 was published for all firewalls running v17.x

    Only v17.x was affected; v18 was not.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:42f2966de5e22c9d…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

Sophos XG Firewall v17 User Portal zero-day (2020), fixed by hotfix HF062020.1

In June 2020 attackers exploited a buffer overflow in the Sophos XG Firewall v17 User Portal before Sophos pushed hotfix HF062020.1 on 25 June 2020.

In plain words

An old Sophos firewall version had a flaw in its user web portal that attackers exploited in June 2020, about a week before Sophos pushed an automatic fix on 25 June 2020. The issue was added to the US government's list of exploited vulnerabilities in 2025, which matters only if we still run that 2020-era software. If we do, it must be upgraded to a supported version and its passwords reset.

What happened and who is affected

What happened

CVE-2020-15069 is a buffer overflow in the HTTP/S bookmark feature of the XG Firewall v17.x User Portal that allows remote code execution on devices with the portal exposed to the internet. Sophos published its advisory and an automatic hotfix that removed the feature on 25 June 2020. Sophos's 2024 'Pacific Rim' report says attackers began exploiting it on 17 June 2020 and returned in 2021 against end-of-life and unpatched devices. CISA added it to its exploited-vulnerabilities catalog in February 2025.

Who is affected

Sophos XG Firewall v17.5 MR12 and earlier (SFOS v17.x) with the User Portal exposed on the WAN. SFOS v18 is not affected.

CVE-2020-15069. Reviewed 23 Oct 2026. https://daystopatch.com/incidents/sophos-cve-2020-15069/

Affected products

  • Sophos XG Firewall (SFOS) v17.x
How we built this timeline

Old incident included because CISA added it to KEV on 6 Feb 2025. The advisory's remediation asks customers to reset administrator and local user passwords, which suggests Sophos was responding to attacks, but it does not say so; when exploitation began relative to the hotfix was not stated in the 2020 advisory;

Sophos's 2024 Pacific Rim timeline settles it (see below). The advisory header says 'Workaround No'; it does recommend disabling User Portal access on the WAN, which is not recorded as a workaround.

Sophos community blog URL from KEV is behind bot protection; the sophos.com advisory page is cited. CVSS 9.8 per NVD (Sophos rates it Critical).

Correction 23 Oct 2026 (audit 2, R4 post-mortem rule): exploited before a fix changed from false to true. Sophos's 'Pacific Rim' timeline (news.sophos.com, 31 Oct 2024, https://news.sophos.com/en-us/2024/10/31/pacific-rim-timeline/) says under 'June 17, 2020: Round 2 starts': 'On this date, 56 days after the Asnarök attack began, the threat actor began to exploit a zero-day buffer overflow vulnerability (CVE-2020-15069) in a custom Apache module.' and under 'June 25, 2020: Cleanup': 'Product engineering released a series of hotfixes, both to patch the CVE-2020-15069 code execution vulnerability and to remove malware installed on the devices.' So exploitation began eight days before the hotfix.

It also records first observed test use on 9 Apr 2020.

Related

No related incidents.

Sophos report card