First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2024-12728

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Sophos	Sophos Firewall	< 20.0 MR3 (20.0.3)

References

https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rcePatch, Vendor Advisory

Timeline

Published: Dec 19, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-127298.8A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older tha CVE-2024-12736.1The Starbox WordPress plugin before 3.5.0 does not sanitise and escape some parameters, which could allow users with a role as low as Contri CVE-2024-127316.1The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading CVE-2024-127326.1The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leadi CVE-2024-127336.1The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leadi CVE-2024-127346.1The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a pa CVE-2024-127357.2The Advance Post Prefix WordPress plugin through 1.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing CVE-2024-127366.1The BU Section Editing WordPress plugin through 0.9.9 does not sanitise and escape a parameter before outputting it back in the page, leadin CVE-2024-127376.1The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outpu CVE-2024-127386.1The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored CVE-2024-127394.8The Mobile Contact Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege use CVE-2024-12745.4The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as S

CVE-2024-12728: Critical severity, CVSS 9.8 | Vulnix