Actively exploited in the wild
Sophos Firewall Code Injection Vulnerability
Sophos - Firewall · Listed in the CISA KEV since 2022-09-23. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-3236
CriticalCVSS 9.8KEVSummary
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
Risk Assessment
An attacker can remotely execute arbitrary code on the firewall, potentially leading to compromise of the device and the entire network. This could result in serious security breaches.
Recommendation
Update Sophos Firewall to the latest version as soon as possible. Also restrict access to management interfaces and monitor for unusual activity.
Other vulnerabilities in Sophos Firewall
Original NVD description (English source)
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.