CVE-2022-3236: critical vulnerability in Sophos Firewall
Published · Updated
95Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 9.8epss 99%
from disclosure to weapon
Published on NVDSep 23
CISA KEVSep 23
exploitation probability
99%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
Action required by CISAfederal deadline: 2022-10-14
Apply updates per vendor instructions.
In short
A code injection flaw in Sophos Firewall lets a remote attacker run arbitrary code on affected systems without needing to log in. This is a critical vulnerability because it gives attackers full control of the firewall.
Technical detail
CWE-94 code injection vulnerability in User Portal and Webadmin components allows unauthenticated remote code execution on Sophos Firewall v19.0 MR1 and earlier. The attack vector is network-based with no authentication required, resulting in complete system compromise.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Sophos · Sophos FirewallRelated CVEs — Sophos Firewall
In the same product, most dangerous first.