Sophos Unified Threat Management UP2DATE vulnerabilities

2 CVEs affecting Sophos Unified Threat Management UP2DATE, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-36807, published 2021-11-26.

More from Sophos.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-8605, published 2016-01-14. Medium severity, CVSS 6.5. EPSS: 82.7% chance of exploitation in the next 30 days. ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet.
• CVE-2021-36807, published 2021-11-26. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. An authenticated user could potentially execute code via an SQLi vulnerability in the user portal of SG UTM before version 9.708 MR8.