Actively exploited in the wild
Sophos Firewall Authentication Bypass Vulnerability
Sophos - Firewall · Listed in the CISA KEV since 2022-03-31. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-1040
CriticalCVSS 9.8KEVSummary
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
Risk Assessment
An attacker can remotely execute arbitrary code on the firewall, potentially leading to full compromise of the device and the entire protected network. The vulnerability is critical as it does not require authentication.
Recommendation
Immediately update Sophos Firewall to a version newer than v18.5 MR3. If updating is not possible, disable access to the User Portal and Webadmin from the Internet.
Other vulnerabilities in Sophos Firewall
Original NVD description (English source)
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.