Actively exploited · Published Sep 23, 2022 · Assigned by Sophos

CVE-2022-3236

Critical 9.8 Exploited

In plain English

A critical-severity code injection in Sophos Firewall from Sophos. Attackers are actively exploiting it in the wild (listed by CISA on September 23, 2022). The chance it is exploited in the next 30 days is estimated at 98.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)98.9%top 0.1% of all CVEs

Exploited in the wildYesCISA KEV since Sep 23, 2022

Attack tooling1Nuclei

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Oct 14, 2022.

Official description

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.

Affected products (as reported)

Vendor	Product	Versions
Sophos	Sophos Firewall	unspecified – through 18.5 MR4unspecified – through 19.0 MR1

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce x_refsource_CONFIRM
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-3236 government-resource