CVE-2017-18014

Think of it like this: an attacker can slip a “trick message” into the firewall’s security log. Later, when an administrator opens that log in the browser, the trick message can “run” like a malicious script in the admin screen.

Because that screen can perform powerful actions (like creating accounts or turning on access methods), this is something you should fix by upgrading.

This matters if you use Sophos XG Firewall running SFOS older than 17.0.3 MR3, especially because the logging/WAF log page can be reached in a default setup.

The attacker does not need to be authenticated to send the initial malicious request, but the administrator must view the specific log report in the webadmin interface for the malicious code to run. In practice, treat it as a risk when the firewall is reachable from the target network and administrators regularly view those WAF logs in the browser.

This is an AMBER issue because the vulnerability can be triggered without authentication and is persistent in logs, so an attacker only needs to get the right log content in place and then rely on an admin opening it. While there is no KEV listing and no public exploit code on record, the ability to execute browser-based admin actions after log viewing is serious.

Act by upgrading to SFOS 17.0.3 MR3 (or later) on your next maintenance window, and treat it as a priority if your admin team routinely views WAF logs in the web interface.