Sophos fixes vulnerability in their Cyberoam OS

guest · Dec 10, 2020

Sophos fixes SQL injection vulnerability in their Cyberoam OS
December 10, 2020
https://www.bleepingcomputer.com/ne...injection-vulnerability-in-their-cyberoam-os/

Sophos has deployed a hotfix for their line of Cyberoam firewalls and routers to fix a SQL injection vulnerability.

Today, Sophos disclosed that a SQL injection vulnerability was fixed in the Cyberoam (CROS) operating system that could remotely add accounts to a CROS device.

"A pre-authentication SQL injection vulnerability was recently discovered and fixed on Cyberoam operating system (CROS) devices. This type of vulnerability could allow SQL statements to be executed remotely, but only if the administration interface (HTTPS admin service) was exposed on the WAN zone," the Sophos advisory explains.
Click to expand...

This vulnerability does not impact Sophos XG Firewall and SG UTM devices.

Sophos has already deployed a hotfix for this vulnerability on all supported versions of CROS, and affected devices should be updated immediately to the latest version. CROS devices utilizing “Allow Over-the-air Hotfix" will automatically have the hotfix delivered to their devices.
Click to expand...

Sophos also advises administrators to disable WAN access to the web admin and SSH interfaces and check the devices for suspicious users.
Click to expand...

Log in or Sign up

Sophos fixes vulnerability in their Cyberoam OS

guest Guest

Log in or Sign up

Sophos fixes vulnerability in their Cyberoam OS

guest Guest

Useful Searches