CVE-2014-2850
HighSummary
The network interface configuration page in Sophos Web Appliance before version 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized access to the system and potential takeover of the device by an attacker.
Recommendation
It is recommended to update Sophos Web Appliance to version 3.8.2 or later to mitigate this vulnerability.
Other vulnerabilities in Sophos Web Appliance
See all- CVE-2017-6412High
In Sophos Web Appliance (SWA) before version 4.3.1.2, a Session Fixation vulnerability may occur, also known as NSWA-1310.
- CVE-2014-2849High
The Change Password dialog box in Sophos Web Appliance before version 3.8.2 allows remote authenticated users to change the admin user password via a crafted request.
- CVE-2013-2642High
Sophos Web Appliance versions before 3.7.8.2 allow remote attackers to execute arbitrary commands via shell metacharacters in the client-ip parameter on the Block page and remote authenticated users to execute arbitrary commands via shell metacharacters in the url and entries parameters.
- CVE-2023-33336Medium
A reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inputted via double quotes.
Original NVD description (English source)
The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter.