Actively exploited · Published Apr 4, 2023 · Assigned by Sophos
CVE-2023-1671
Critical 9.8 Exploited
In plain English
A critical-severity command injection in Sophos Web Appliance from Sophos. Attackers are actively exploiting it in the wild (listed by CISA on November 16, 2023). The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Dec 7, 2023.
Official description
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sophos | Sophos Web Appliance | unspecified – before 4.3.10.4 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H