Actively exploited · Published Mar 25, 2022 · Assigned by Sophos
CVE-2022-1040
Critical 9.8 Exploited
In plain English
A critical-severity security flaw in Sophos Firewall from Sophos. Attackers are actively exploiting it in the wild (listed by CISA on March 31, 2022). The chance it is exploited in the next 30 days is estimated at 99.8% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply updates per vendor instructions.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)99.8%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since Mar 31, 2022
Attack tooling2Nuclei, Public PoC
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Apr 21, 2022.
Official description
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sophos | Sophos Firewall | unspecified – through 18.5 MR3 |
References
- https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce x_refsource_CONFIRM
- http://packetstormsecurity.com/files/168046/Sophos-XG115w-Firewall-17.0.10-MR-10-Authentication-Bypass.html x_refsource_MISC
- https://www.exploit-db.com/exploits/51006 x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-1040 government-resource