CVE-2017-18014

CVE-2017-18014 describes a persistent Cross-Site Scripting (XSS) vulnerability in the Logging subsystem of Sophos XG Firewall with SFOS before version 17.0.3 MR3. An unauthenticated attacker can exploit this by injecting malicious script into the User-Agent parameter of an HTTP POST request, which is then executed on the WAF log page of the webadmin interface. This allows the attacker to perform any action available to the webadmin, such as creating users or enabling SSH. Rated Medium severity (CVSS 6.1), the attack requires user interaction (UI:R) but can lead to significant compromise of the firewall's administrative functions. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.