Actively exploited in the wild
Sophos Web Appliance Command Injection Vulnerability
Sophos - Web Appliance · Listed in the CISA KEV since 2023-11-16. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-1671
CriticalCVSS 9.8KEVSummary
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.
Risk Assessment
An unauthenticated attacker could remotely execute arbitrary code on the device, potentially leading to full compromise of the web gateway.
Recommendation
Immediately update Sophos Web Appliance to version 4.3.10.4 or later. Check for unauthorized access.
Other vulnerabilities in Sophos Web Appliance
See all- CVE-2017-6412High
In Sophos Web Appliance (SWA) before version 4.3.1.2, a Session Fixation vulnerability may occur, also known as NSWA-1310.
- CVE-2014-2850High
The network interface configuration page in Sophos Web Appliance before version 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter.
- CVE-2014-2849High
The Change Password dialog box in Sophos Web Appliance before version 3.8.2 allows remote authenticated users to change the admin user password via a crafted request.
- CVE-2013-2642High
Sophos Web Appliance versions before 3.7.8.2 allow remote attackers to execute arbitrary commands via shell metacharacters in the client-ip parameter on the Block page and remote authenticated users to execute arbitrary commands via shell metacharacters in the url and entries parameters.
- CVE-2023-33336Medium
A reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inputted via double quotes.
Original NVD description (English source)
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.