CVE-2017-18014

Think of it like this: an attacker can slip a “trick message” into the firewall’s security log. Later, when an administrator opens that log in the browser, the trick message can “run” like a malicious script in the admin screen.

Because that screen can perform powerful actions (like creating accounts or turning on access methods), this is something you should fix by upgrading.

This matters if you use Sophos XG Firewall running SFOS older than 17.0.3 MR3, especially because the logging/WAF log page can be reached in a default setup.

The attacker does not need to be authenticated to send the initial malicious request, but the administrator must view the specific log report in the webadmin interface for the malicious code to run. In practice, treat it as a risk when the firewall is reachable from the target network and administrators regularly view those WAF logs in the browser.

This is an AMBER issue because the vulnerability can be triggered without authentication and is persistent in logs, so an attacker only needs to get the right log content in place and then rely on an admin opening it. While there is no KEV listing and no public exploit code on record, the ability to execute browser-based admin actions after log viewing is serious.

Act by upgrading to SFOS 17.0.3 MR3 (or later) on your next maintenance window, and treat it as a priority if your admin team routinely views WAF logs in the web interface.

Confirm exposure (what to check)

1. Log into Sophos XG Firewall and find the SFOS version.
2. Determine whether your version is before 17.0.3 MR3. If it is, you are in scope for CVE-2017-18014.

Upgrade / fix

3. Upgrade to SFOS 17.0.3 MR3 or later.
4. After the upgrade, re-check that the firewall reports the updated SFOS version and that the relevant webadmin log viewer pages work.

Validate it’s no longer vulnerable

5. If you have a staging environment, test by reproducing the same log-viewing workflow used by administrators (e.g., opening the relevant WAF log viewer page) and confirm no injected content appears to execute.
6. In production, monitor for any anomalous admin actions that occur around times when admins view WAF logs—especially changes consistent with “admin actions available to the webadmin” (for example, account creation or enabling remote access).

Workarounds (if patching is delayed)

• Because exploitation depends on an administrator viewing the affected log report in the browser, limit exposure by tightening admin access paths and reducing direct webadmin log viewing by non-essential staff.
• If your organization can, prioritize viewing logs through safer methods outside the vulnerable browser workflow until you complete the SFOS upgrade.

Notes on exploit status

• This CVE is not listed in CISA KEV and there is no public exploit code recorded. However, the issue is persistent and has a direct path to browser-executed actions in the admin interface when an admin views the log report.

CVE-2017-18014 is a persistent XSS (CWE-79) in the Logging subsystem of Sophos XG Firewall (SFOS). The attacker can send specially crafted input that gets inserted into WAF log content; later, when an administrator views the WAF log page in the webadmin interface (including using the filter option under “Web Server Protection”), the page executes attacker-controlled content from an HTTP POST parameter (described as the “User-Agent” parameter).

Key attack characteristics from the findings:

• Initial payload delivery requires no authentication.
• Administrator interaction is required: the admin must view the specific log report in the browser.
• Reachability: the issue is reachable in default configuration.
• Impact mechanism: once the injected script runs, it can execute actions available to the webadmin (including creating users or enabling SSH/authorized keys).

KEV: not listed.
Exploit maturity: no public exploit code on record.
EPSS: provided as a prediction and not used to justify urgency given the direct admin-execution pathway described in the findings.