Re: KBA 135412 - XG Firewall Vulnerability Notification: Not showing hotfix information in CLI for 1x XG 115w Firewall

I have 5 firewalls, all of them are on 17.5.0 GA and none of them shows whether the hotfix was applied and whether they were compromised. What is the hotfix version they should be on?

Rebooted two of them, updated firmware, waited 30 minutes. Nothing.

Mine finally automatically installed the hotfix update and said compromised. So, I've changed all local passwords and rebooted. Have also disabled the sslvpn just in case over the weekend until we get more updates from Sophos.

I did much the same but we use L2TP with AD credentials along with Sophos Connect with AD credentials.

It would be nice to see what they actually did / saw / transferred out of / in to my XG Firewalls

We appear to have had our SFM instance (on-prem, not central) URL removed from all our devices that the hotfix returned "partially cleaned" on.

Unsure if the hotfix has done it, or the exploit impacted it so it was removed.

Anyone else witnessed this?

Hi M8ey 

At this time, there is no indication that the attack accessed anything on the local networks behind any impacted XG Firewall. It appears the attack was designed to download payloads intended to exfiltrate XG Firewall-resident data.

The data for any specific firewall depends upon the specific configuration and may include usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access. Passwords associated with external authentication systems such as AD or LDAP are unaffected.

We are continuing to investigate and expect to release more details of the attack. Please follow https://community.sophos.com/kb/en-us/135412 for further updates.

Hi M8ey 

At this time, there is no indication that the attack accessed anything on the local networks behind any impacted XG Firewall. It appears the attack was designed to download payloads intended to exfiltrate XG Firewall-resident data.

The data for any specific firewall depends upon the specific configuration and may include usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access. Passwords associated with external authentication systems such as AD or LDAP are unaffected.

We are continuing to investigate and expect to release more details of the attack. Please follow https://community.sophos.com/kb/en-us/135412 for further updates.

Yes I read that Flo - I have actioned all recommended pints with resetting any local passwords, rebooting etc.

As I use L2TP and Sophos Connect with users authentication with AD I assume these passwords are safe as they were not local users?

Yes, passwords associated with external authentication systems such as AD or LDAP are unaffected.