Sophos Tester vulnerabilities

2 CVEs affecting Sophos Tester, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-6319, published 2018-02-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-6318, published 2018-02-02. High severity, CVSS 7.8. EPSS: 1% chance of exploitation in the next 30 days. In Sophos Tester Tool 3.2.0.7 Beta, the driver loads (in the context of the application used to test an exploit or ransomware) the DLL using a payload that runs from NTDLL.DLL (so, it's run in…
CVE-2018-6319, published 2018-02-02. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. In Sophos Tester Tool 3.2.0.7 Beta, the driver accepts a special DeviceIoControl code that doesn't check its argument. This argument is a memory address: if a caller passes a NULL pointer or a random…