Sophos discloses critical Firewall remote code execution flaw

Sophos disclosed three vulnerabilities in Sophos Firewall (CVE-2024-12727, CVE-2024-12728, CVE-2024-12729) that can allow pre-auth SQL injection with potential remote code execution in a specific SPX+HA configuration, predictable SSH passphrases enabling unauthorized privileged access during HA initialization, and an authenticated code injection in the User Portal. The vendor published hotfixes (installed by default) and permanent fixes in newer firmware, provided mitigation guidance (restrict SSH, avoid exposing management interfaces), and estimated that the issues affect a small percentage of deployed devices.