Overview

An SQL Injection vulnerability in the WebAdmin of Cyberoam OS was recently discovered and has been patched through a hotfix. On some systems, this may have been used to create an unrecognized account.

Applies to the following Sophos product(s) and version(s)

• All Cyberoam OS devices

Remediation

• Hotfix distributed to all supported Cyberoam OS devices starting December 4 2020
• Hotfix also distributed to unsupported EOL Cyberoam versions 10.6.2 and later
• Additionally, Sophos recommends that Cyberoam customers upgrade to XG Firewall v17.5 or the latest available Cyberoam OS release

Recommendation

Customers can further protect themselves by ensuring their Web Admin and SSH access is not exposed to WAN (System > Administration > Appliance Access).

Related Information

• CVE-2020-29574