Sophos · Firewall
CVE-2022-1040
Sophos Firewall Authentication Bypass Vulnerability
Exploited in attacks
Critical 9.8 Attack chance: 99.8%
What it is
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
CISA: An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: April 21, 2022
More exploited flaws from Sophos
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 23, 2022 | Code Injection | Firewall | Critical 9.8 | 99% |
| Feb 6, 2025 | Buffer Overflow | XG Firewall | Critical 9.8 | 11% |
| Feb 6, 2025 | (CROS) SQL Injection | CyberoamOS | Critical 9.8 | 4.7% |
| Nov 16, 2023 | Command Injection | Web Appliance | Critical 9.8 | >99.9% |
| Mar 25, 2022 | Remote Code Execution | SG UTM | Critical 9.8 | 97% |
| Nov 3, 2021 | SQL Injection | SFOS | Critical 10.0 | 42% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.