CVE-2024-12728: Sophos Firewall Auth Bypass Vulnerability

CVE-2024-12728 Overview

CVE-2024-12728 is a weak credentials vulnerability affecting Sophos Firewall firmware that potentially allows privileged system access via SSH. This critical security flaw impacts Sophos Firewall versions older than 20.0 MR3 (20.0.3), enabling unauthorized attackers to gain elevated access to the firewall's underlying system through the SSH interface.

Critical Impact

Attackers can potentially gain privileged system access to Sophos Firewall appliances via SSH, compromising network perimeter security and enabling full administrative control over firewall configurations, traffic inspection, and network routing.

Affected Products

• Sophos Firewall Firmware versions prior to 20.0 MR3 (20.0.3)
• Sophos Firewall hardware appliances running vulnerable firmware
• Sophos Firewall virtual appliances with affected firmware versions

Discovery Timeline

• 2024-12-19 - CVE-2024-12728 published to NVD
• 2025-11-12 - Last updated in NVD database

Technical Details for CVE-2024-12728

Vulnerability Analysis

This vulnerability is classified under CWE-1391 (Use of Weak Credentials), indicating that the Sophos Firewall contains credential weaknesses that can be exploited by attackers. The flaw exists in the SSH authentication mechanism of the firewall firmware, where weak or predictable credentials allow unauthorized parties to establish privileged sessions.

The attack can be executed remotely over the network without requiring prior authentication or user interaction. Once exploited, an attacker achieves the same level of access as a legitimate administrator, allowing them to modify firewall rules, intercept traffic, disable security features, pivot to internal networks, and potentially exfiltrate sensitive configuration data including VPN credentials and network topology information.

Root Cause

The root cause of CVE-2024-12728 stems from weak credential implementation in the Sophos Firewall SSH service. This vulnerability type (CWE-1391) typically arises from default credentials, predictable password generation algorithms, or insufficient credential complexity requirements during the High Availability (HA) cluster initialization process where SSH passphrase may remain active after the process completes.

Attack Vector

The vulnerability is exploitable via the network attack vector, allowing remote attackers to target exposed Sophos Firewall SSH interfaces. The attack flow involves:

1. Reconnaissance: Attacker identifies Sophos Firewall appliances with SSH services exposed to the network
2. Credential Exploitation: Attacker leverages weak credentials to authenticate to the SSH service
3. Privileged Access: Upon successful authentication, the attacker gains elevated system access
4. Post-Exploitation: Attacker can modify firewall configurations, access internal networks, or establish persistence

Since the vulnerability requires no user interaction and no prior privileges, any internet-facing Sophos Firewall with SSH enabled is potentially at risk. Organizations should review their firewall configurations and ensure SSH access is properly restricted and credentials are rotated.

Detection Methods for CVE-2024-12728

Indicators of Compromise

• Unexpected SSH login events from unknown or external IP addresses in firewall authentication logs
• Anomalous administrative changes to firewall rules or configurations without authorized change requests
• Multiple failed SSH authentication attempts followed by successful login from the same source
• Unusual outbound connections originating from the firewall appliance itself

Detection Strategies

• Monitor SSH authentication logs on Sophos Firewall for successful logins from unexpected geographic locations or IP ranges
• Implement network-based detection for SSH traffic to firewall management interfaces from untrusted networks
• Deploy SIEM rules to correlate firewall configuration changes with SSH login events
• Audit administrative account usage and compare against authorized personnel access patterns

Monitoring Recommendations

• Enable detailed SSH logging on all Sophos Firewall appliances and forward logs to a centralized SIEM
• Configure alerts for SSH login events outside of normal maintenance windows
• Implement network segmentation monitoring to detect lateral movement from compromised firewalls
• Regularly review firewall rule changes and configuration modifications for unauthorized alterations

How to Mitigate CVE-2024-12728

Immediate Actions Required

• Upgrade all Sophos Firewall appliances to version 20.0 MR3 (20.0.3) or later immediately
• Restrict SSH access to trusted management networks only using firewall access rules
• Change all administrative credentials and SSH passphrases on affected devices
• Review recent SSH login history for signs of unauthorized access
• Disable SSH access from WAN interfaces if not strictly required

Patch Information

Sophos has released version 20.0 MR3 (20.0.3) to address this vulnerability. Administrators should apply this update as the primary remediation measure. Detailed patch information and upgrade instructions are available in the Sophos Security Advisory.

Workarounds

• Disable SSH access entirely on the firewall if administrative CLI access is not required
• Implement IP allowlisting to restrict SSH connections to specific trusted management workstations
• Enable multi-factor authentication for administrative access where supported
• Deploy a VPN requirement for all administrative access to firewall management interfaces

# Example: Restrict SSH access to management network only
# Access Sophos Firewall CLI and configure device access settings
# Navigate to: Administration > Device Access
# Disable SSH access from WAN zone
# Enable SSH only from LAN or dedicated management zone
# Set Local Service ACL to restrict SSH to specific IP addresses