PT-2022-4853 · Sophos · Sophos Firewall

Published 2022-09-23 · Updated 2026-02-10 · CVE-2022-3236

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sophos Firewall versions prior to v19.0 MR1

Description A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows a remote attacker to execute code. The vulnerability is being actively exploited by hackers in attacks. Over 4000 servers are still vulnerable to this critical bug.

Recommendations For Sophos Firewall versions prior to v19.0 MR1, apply the backported security update to fix the code injection vulnerability. As a temporary workaround, consider restricting access to the User Portal and Webadmin until the update is applied.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2022-05927

CVE-2022-3236

Affected Products

Sophos Firewall

References · 76

• 🔥❌ https://github.com/subvers1on/CVE-2022-3236-RCE-PoC · Exploit, Deleted
• 🔥❌ https://github.com/Adynervi/CVE-2022-3236-MASS-RCE · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-3236 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3236 · Security Note
• https://bdu.fstec.ru/vul/2022-05927 · Security Note
• https://twitter.com/hackplayers/status/1734893448677687767 · Twitter Post
• https://t.me/pentestingnews/42021 · Telegram Post
• https://t.me/true_secator/3794 · Telegram Post
• https://twitter.com/shah_sheikh/status/1734892191783551068 · Twitter Post
• https://twitter.com/rst_cloud/status/1853166119583875405 · Twitter Post
• https://twitter.com/rst_cloud/status/1861371858236407815 · Twitter Post
• https://t.me/pentestingnews/28376 · Telegram Post
• https://twitter.com/evanderburg/status/1734892227871363362 · Twitter Post
• https://twitter.com/helpnetsecurity/status/1734893578822807917 · Twitter Post
• https://twitter.com/HammoheadNet/status/1868308072642560030 · Twitter Post