Re: KBA 135412 - XG Firewall Vulnerability Notification: Not showing hotfix information in CLI for 1x XG 115w Firewall

Edit, I re-ran the command and it's now showing Hot Fix version: 1. Is that the one I need to be on?

Also, no new notifications in the dashboard though.

I have the same issue on one of my XG firewalls - once was compromised and one has no notifications :-(

Edit: after reboot it was there

I have 5 firewalls, all of them are on 17.5.0 GA and none of them shows whether the hotfix was applied and whether they were compromised. What is the hotfix version they should be on?

15 units on SFOS 18.0.0 GA-Build354, and no notice.

Most show hotfix v2.

Paul

Same here...

Rebooted two of them, updated firmware, waited 30 minutes. Nothing.

Mine finally automatically installed the hotfix update and said compromised. So, I've changed all local passwords and rebooted. Have also disabled the sslvpn just in case over the weekend until we get more updates from Sophos.

I did much the same but we use L2TP with AD credentials along with Sophos Connect with AD credentials.

It would be nice to see what they actually did / saw / transferred out of / in to my XG Firewalls

We appear to have had our SFM instance (on-prem, not central) URL removed from all our devices that the hotfix returned "partially cleaned" on.

Unsure if the hotfix has done it, or the exploit impacted it so it was removed.

Anyone else witnessed this?

Hi M8ey 

At this time, there is no indication that the attack accessed anything on the local networks behind any impacted XG Firewall. It appears the attack was designed to download payloads intended to exfiltrate XG Firewall-resident data.

The data for any specific firewall depends upon the specific configuration and may include usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access. Passwords associated with external authentication systems such as AD or LDAP are unaffected.

We are continuing to investigate and expect to release more details of the attack. Please follow https://community.sophos.com/kb/en-us/135412 for further updates.