KBA 135412 - XG Firewall Vulnerability - SQL Injection - HTTPS 8443 Port

Question

Hello, 
 
 I have checked all the firewalls I'm managing for my custommers and all I can say is that on 46 firewalls that I manage, 9 have been compromised with this SQL injection. The only thing which differs on the 9 compromised firewalls compared to the 37 others, is the HTTPS port used for the User Portal. The 9 compromised firewalls were using the 8443 HTTPS port for User Portal. The 37 other firewalls are not using this port, but another one and they are not affected by this attack. 
 
 So maybe the vulnerability can only affect the firewalls with the 8443 HTTPS port on the user portal ? 
 
 Regards.

FloSupport · Answer

After analyzing the components and intent of the attack, Sophos published a SophosLabs Uncut article, &ldquo;Asnarok&rdquo; Trojan targets firewalls , to share its current understanding of the malware.