VendorsEdge, Security
Sophos
Sophos makes Sophos Firewall (formerly XG Firewall and Cyberoam), Intercept X endpoint protection, the Sophos Central management platform and managed detection and response services.
- Response trend, 6 months
- Not enough history
- Open now
- None
- Latest incident
- 10 Dec 2020
- Incidents on record
- 2
Response to exploited bugs
Not rated. No reviewed zero-days yet.
Fixing privately reported bugs
Not rated. No private reports in the grading window.
What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work
Why these grades
Every clock starts at the first public report.
- Response to exploited bugs: not rated. No reviewed exploited zero-days in the last 36 months, so this grade does not apply yet.
- Fixing privately reported bugs: not rated. No private reports in the last 36 months.
- No exploited incidents on record for the last 36 months.
- NR (not rated) means a subject has fewer than 3 data points from the last 36 months, or their recency weights add up to less than one current data point. For response, a data point is a reviewed exploited zero-day. For private fixes, it is a private report (one vendor, one report date). KEV listings alone never rate a vendor. A grade is provisional when the vendor's own evidence does not yet outweigh the starting value, or confidence is below medium.
Response to exploited bugs: sub-scores
- Time to first advisoryNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- Time to first fixNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- Time to fix all versionsNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- OpennessAdvisories available by RSS623 cases, low confidence, not used for this vendor
Fixing privately reported bugs: sub-score
- Private fix speedNo private reports in the last 36 monthsNR0 cases, not used
Response fingerprint
Counts toward the response grade 0
No incidents count toward the grade yet.
Not graded 2: n-days, unreviewed timelines and end-of-life products
- 10 Dec 2020CyberoamOS WebAdmin SQL injection (2020), used to create rogue accountsNot graded: before window
- 25 Jun 2020Sophos XG Firewall v17.x User Portal bookmark buffer overflow (2020)Not graded: before window
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Open, no fix
- Open, partly fixed
- Fixed when disclosed
- Date only, no time of day
One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.
Exploited incidents
2 in 24 months, 1 with known ransomware use, 100% exploited before a fix
| First report | Incident | CVSS | Silence | First fix | All fixed | Status | Grade |
|---|---|---|---|---|---|---|---|
| 10 Dec 2020 | CyberoamOS WebAdmin SQL injection (2020), used to create rogue accountsCVE-2020-29574 | 9.8 | same day | same day | same day | Fixed | Not graded: before window |
| 25 Jun 2020 | Sophos XG Firewall v17.x User Portal bookmark buffer overflow (2020)CVE-2020-15069 | 9.8 | same day | same day | same day | Fixed | Not graded: before window |
Private reports
None in the window
Bugs reported privately to Sophos by ZDI or Project Zero.
No privately reported cases from ZDI or Project Zero in the window.
Grade history
Response to exploited bugs: score at the end of each month.
Not rated at any point in this period.
Channels
Get Sophos's own alerts
- RSSSophos security advisories RSSAdd the advisory feed to a feed reader or chat integration.
- MastodonSophos X-Ops on MastodonFollow the account.
- Advisory pageSophos security advisoriesCheck the advisory page. It has no push channel.
What we watch
- RSSSophos security advisories RSS
- MastodonSophos X-Ops on Mastodon
See sources and health for when each was last read.
Grade not rated.