Sophos Hitmanpro.alert vulnerabilities

4 CVEs affecting Sophos Hitmanpro.alert, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-25270, published 2021-10-08.

More from Sophos.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-3971, published 2018-10-25. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. An exploitable arbitrary write vulnerability exists in the 0x2222CC IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP request can cause the driver to write data…
• CVE-2018-3970, published 2018-10-25. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. An exploitable memory disclosure vulnerability exists in the 0x222000 IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP request can cause the driver to return…
• CVE-2020-9540, published 2020-03-02. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. Sophos HitmanPro.Alert before build 861 allows local elevation of privilege.
• CVE-2021-25270, published 2021-10-08. Medium severity, CVSS 6.7. EPSS: 0.3% chance of exploitation in the next 30 days. A local attacker could execute arbitrary code with administrator privileges in HitmanPro.Alert before version Build 901.