Sophos · Firewall

CVE-2022-3236

Sophos Firewall Code Injection Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 99%

What it is

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.

CISA: A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: October 14, 2022

Added to the CISA list: September 23, 2022
Published: September 23, 2022
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 99% in the top 0.1% of all known vulnerabilities
Weakness: CWE-94
More details: NVD · CVE.org · CISA

All references (1)

https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce

More exploited flaws from Sophos

Added	Vulnerability	Product	Severity	Attack chance
Mar 31, 2022	Authentication BypassCVE-2022-1040	Firewall	Critical 9.8	99.8%
Feb 6, 2025	Buffer OverflowCVE-2020-15069	XG Firewall	Critical 9.8	11%
Feb 6, 2025	(CROS) SQL InjectionCVE-2020-29574used by ransomware	CyberoamOS	Critical 9.8	4.7%
Nov 16, 2023	Command InjectionCVE-2023-1671	Web Appliance	Critical 9.8	>99.9%
Mar 25, 2022	Remote Code ExecutionCVE-2020-25223	SG UTM	Critical 9.8	97%
Nov 3, 2021	SQL InjectionCVE-2020-12271used by ransomware	SFOS	Critical 10.0	42%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.