Sophos XG 17.5 MR12 Mandatory Password Reset Page???

Hello, 

We are running Sophos XG with Firmware 17.5 MR-11 . 

Today we saw the same screen "Mandatory Password reset" on our firewall. 

Can anyone please confirm that this is legitimate action by Sophos pushed by the Company itself. because we got no information from Sophos.

we would like to mention that our device was recently compromised and patched by Sophos against the recent "SQL Injection" attack. and we already have changed our password according to the given KB.

Hi All,

Sophos is enforcing a password reset for the XG administrator and all other local administrator accounts that have not reset passwords since the security hotfix was applied at 2200 UTC on April 25, 2020. Where required, administrative accounts will be prompted to change passwords upon logging into an XG Firewall. The password reset is shown only on an XG Firewall that was identified as impacted AND the password has not been changed since 2200 UTC on April 25, 2020.

Admins will still receive the password reset request even if multi-factor authentication is enabled. The last date/time check for the password change is determined locally on the firewall from logged events. In the event a positive determination cannot be made, admins will be forced to change their password.

Hi All,

Sophos is enforcing a password reset for the XG administrator and all other local administrator accounts that have not reset passwords since the security hotfix was applied at 2200 UTC on April 25, 2020. Where required, administrative accounts will be prompted to change passwords upon logging into an XG Firewall. The password reset is shown only on an XG Firewall that was identified as impacted AND the password has not been changed since 2200 UTC on April 25, 2020.

Admins will still receive the password reset request even if multi-factor authentication is enabled. The last date/time check for the password change is determined locally on the firewall from logged events. In the event a positive determination cannot be made, admins will be forced to change their password.

Hi Flo,

Thank you for explaining this to us.

You have mentioned that the mandatory password reset is for firewalls that are affected and the password has not been changed since 2200H UTC on April 25,2020.

As per my understanding it is an AND statement not an OR statement.

We've have already changed our password last 26th of April as per checking via Admin events thus removing us from the coverage bracket of the AND statement above. 

I am really wondering why I myself or my other teammates will still again redo this even if we areaare done with it and followed the recommendations that you have provided on KB.

Is there a way to remove the "password reset required flags" manually? (We reset the passwords after the hotfix had been applied to our firewall but before the Sophos cutoff time of 22:00 UTC, when the hotfix had been applied to all hotfix-enabled firewalls.)

Apologies for the any inconvenience caused by this enforced password reset.

Hi S023A

That is correct that this is an AND statement. Could you please raise a case and PM me with the case number for further investigation of your situation?

Hi Guilherme Santos 

Unfortunately for security purposes, there is no way to skip this enforced password reset.

Regards,

Hi FloSupport 

I already filed a case today and waiting for the email to come in for the case number. I will send it to you.