Sophos Firewall vulnerabilities

3 CVEs affecting Sophos Firewall, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-5552, published 2023-10-18.

More from Sophos.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-3236: Sophos Firewall Code Injection Vulnerability, published 2022-09-23. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-09-23. EPSS: 98.9% chance of exploitation in the next 30 days. A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
• CVE-2022-1807, published 2022-09-07. High severity, CVSS 7.2. EPSS: 1.1% chance of exploitation in the next 30 days. Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18.5 MR4 and version 19.0 MR1.
• CVE-2023-5552, published 2023-10-18. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the…