CVE-2022-0331: Sophos SFOS

Medium severity, CVSS 5.3. EPSS: 1.5% chance of exploitation in the next 30 days.

An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos Firewall version v18.5 MR2 and older.

Affected products

• Sophos SFOS: up to and including 18.5.2

Published 2022-03-29. Last modified 2026-06-17.