Firewall
Monthly
Security policy bypass in Forcepoint Security Engine (NGFW) versions 7.1.0 through 7.1.13, 7.3.0 through 7.3.1, 7.3.3, 7.4.0 through 7.4.1, and 7.5.0 allows unauthenticated network attackers to defeat the enforcement policy the appliance is supposed to apply to traffic passing through it. Because the appliance itself is not the target, impact falls on downstream systems that the NGFW is meant to protect - an attacker who exploits the flaw can make traffic the policy should block appear permitted, with high integrity impact on those subsequent systems (scope-changed). The CVSS 4.0 base score is 7.9 (AV:N/AC:L/AT:N/PR:N/UI:N with subsequent-system impact H/H/H) and the issue is tagged as an authentication bypass; no CISA KEV entry is present and no public exploit code has been identified at time of analysis, though no EPSS data was supplied for this CVE. Exploitation is limited primarily by deployment context rather than access difficulty - the target must actually be enforcing a policy the bypass can negate.
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in the IPFire firewall distribution (versions before 2.29 Core Update 198) lets an authenticated administrator inject arbitrary JavaScript through the txt_mailuser and txt_mailpass fields of the mail-server settings form, which is posted to /cgi-bin/mail.cgi. Because those values are persisted and later rendered in the web UI without sanitisation or encoding, the script executes in the browser session of any other user who opens the affected mail configuration page, enabling session theft or privileged actions in that user's context. Authentication is required (CVSS 4.0 vector shows PR:L) and the victim must view the page (UI:P), so exploitation is a two-party, low-privilege-to-privileged chain; EPSS is 0.45% (37th percentile), no public exploit code is known, and the issue is fixed in Core Update 198.
Comodo Firewall Link Following Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Implicit intent hijacking vulnerability in Firewall application prior to versions 12.1.00.24 in Android 11, 13.1.00.16 in Android 12 and 14.1.00.7 in Android 13 allows 3rd party application to tamper. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18.5 MR4 and version 19.0 MR1. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Comodo Antivirus through 12.0.0.6870, Comodo Firewall through 12.0.0.6870, and Comodo Internet Security Premium through 12.0.0.6870, with the Comodo Container feature, are vulnerable to Sandbox. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Endian Firewall 2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) createrule parameter to dnat.cgi, (2) addrule. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Security policy bypass in Forcepoint Security Engine (NGFW) versions 7.1.0 through 7.1.13, 7.3.0 through 7.3.1, 7.3.3, 7.4.0 through 7.4.1, and 7.5.0 allows unauthenticated network attackers to defeat the enforcement policy the appliance is supposed to apply to traffic passing through it. Because the appliance itself is not the target, impact falls on downstream systems that the NGFW is meant to protect - an attacker who exploits the flaw can make traffic the policy should block appear permitted, with high integrity impact on those subsequent systems (scope-changed). The CVSS 4.0 base score is 7.9 (AV:N/AC:L/AT:N/PR:N/UI:N with subsequent-system impact H/H/H) and the issue is tagged as an authentication bypass; no CISA KEV entry is present and no public exploit code has been identified at time of analysis, though no EPSS data was supplied for this CVE. Exploitation is limited primarily by deployment context rather than access difficulty - the target must actually be enforcing a policy the bypass can negate.
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in the IPFire firewall distribution (versions before 2.29 Core Update 198) lets an authenticated administrator inject arbitrary JavaScript through the txt_mailuser and txt_mailpass fields of the mail-server settings form, which is posted to /cgi-bin/mail.cgi. Because those values are persisted and later rendered in the web UI without sanitisation or encoding, the script executes in the browser session of any other user who opens the affected mail configuration page, enabling session theft or privileged actions in that user's context. Authentication is required (CVSS 4.0 vector shows PR:L) and the victim must view the page (UI:P), so exploitation is a two-party, low-privilege-to-privileged chain; EPSS is 0.45% (37th percentile), no public exploit code is known, and the issue is fixed in Core Update 198.
Comodo Firewall Link Following Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Implicit intent hijacking vulnerability in Firewall application prior to versions 12.1.00.24 in Android 11, 13.1.00.16 in Android 12 and 14.1.00.7 in Android 13 allows 3rd party application to tamper. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18.5 MR4 and version 19.0 MR1. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Comodo Antivirus through 12.0.0.6870, Comodo Firewall through 12.0.0.6870, and Comodo Internet Security Premium through 12.0.0.6870, with the Comodo Container feature, are vulnerable to Sandbox. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Endian Firewall 2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) createrule parameter to dnat.cgi, (2) addrule. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.