critical9.8Known exploited
CVE-2022-3236
Sophos Firewall Code Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-09-23. Federal due date: 2022-10-14.
Apply updates per vendor instructions.
Impact
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sophos | Firewall | through 19.0.1 |