Sophos Hitmanpro vulnerabilities

4 CVEs affecting Sophos Hitmanpro, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-25271, published 2021-10-08.

More from Sophos.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-6008, published 2017-09-13. High severity, CVSS 7.8. EPSS: 1.9% chance of exploitation in the next 30 days. A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos Clean) allows local users to escalate…
• CVE-2017-7441, published 2017-09-13. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. In Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos Clean), a crafted IOCTL with code 0x22E1C0 might lead to kernel data leaks. Because the leak…
• CVE-2017-6007, published 2017-09-13. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos Clean) allows local users to crash the…
• CVE-2021-25271, published 2021-10-08. Medium severity, CVSS 6.0. EPSS: 0.2% chance of exploitation in the next 30 days. A local attacker could read or write arbitrary files with administrator privileges in HitmanPro before version Build 318.