Sophos · Web Appliance
CVE-2023-1671
Sophos Web Appliance Command Injection Vulnerability
Exploited in attacks
Critical 9.8 Attack chance: >99.9%
What it is
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.
CISA: Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: December 7, 2023
More exploited flaws from Sophos
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Feb 6, 2025 | Buffer Overflow | XG Firewall | Critical 9.8 | 11% |
| Feb 6, 2025 | (CROS) SQL Injection | CyberoamOS | Critical 9.8 | 4.7% |
| Sep 23, 2022 | Code Injection | Firewall | Critical 9.8 | 99% |
| Mar 31, 2022 | Authentication Bypass | Firewall | Critical 9.8 | 99.8% |
| Mar 25, 2022 | Remote Code Execution | SG UTM | Critical 9.8 | 97% |
| Nov 3, 2021 | SQL Injection | SFOS | Critical 10.0 | 42% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.