Voltar à Visão geral dos comunicados de segurança
Critical
CVE
CVE-2019-17059
Updated:
Produto(s)
Cyberoam OS Devices
ID da publicação
sophos-sa-20191016.1-cyberoam-rce
Versão do artigo
1
Primeira publicação
Solução alternativa
No
Overview
A critical shell injection vulnerability in Sophos Cyberoam Firewall appliances running CyberoamOS (CROS) version 10.6.6 MR-5 and earlier was recently discovered and responsibly disclosed to Sophos by an external security researcher.
The vulnerability can be potentially exploited by sending a malicious request to either the Web Admin or SSL VPN consoles, which would enable an unauthenticated remote attacker to execute arbitrary commands.
Applies to the following Sophos products and versions
- Cyberoam Firewalls running CROS 10.6.6 MR-5 and earlier
Remediation
- For customers running CROS version 10.6.4 and later, who use the default automatic updates setting, the security update has been automatically installed since September 30, 2019 and there is no action required.
- For customers who keep automatic updates disabled or otherwise cannot receive them, the patch is available via Sophos Support.
- The hotfix for the vulnerability will also be included in CROS version 10.6.6 MR-6.