Multiple Vulnerabilities in Sophos Firewall Could Allow for Remote Code Execution

Multiple critical vulnerabilities were disclosed in Sophos Firewall: a pre-auth SQL injection in the email protection feature enabling remote code execution (CVE-2024-12727), a post-auth code injection in the User Portal enabling RCE (CVE-2024-12729), and an HA SSH passphrase exposure that could reveal a privileged account (CVE-2024-12728). Successful exploitation could provide unauthorized system access and allow attackers to view, modify, or delete data.