CVE-2013-4983: Sophos Web Appliance Firmware

High severity, CVSS 10.0. EPSS: 90.1% chance of exploitation in the next 30 days.

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to end-user/index.php.

Affected products

• Sophos Web Appliance Firmware: version 3.7.8 only; up to and including 3.7.9; version 3.0.0 only; version 3.0.1 only; version 3.0.1.1 only; version 3.0.2 only; …

Published 2013-09-10. Last modified 2026-06-16.