Sophos Connect vulnerabilities

4 CVEs affecting Sophos Connect, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-4901, published 2023-03-01.

More from Sophos.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-25265, published 2021-03-22. High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days. A malicious website could execute code remotely in Sophos Connect Client before version 2.1.
• CVE-2022-48309, published 2023-03-01. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90.
• CVE-2022-4901, published 2023-03-01. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a malicious VPN configuration that must be manually loaded by the…
• CVE-2022-48310, published 2023-03-01. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90.