CVE-2014-2849: Sophos Web Appliance change_password access control flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityA remotely reachable, publicly exploited flaw that yields full administrative takeover of the appliance, though it requires an authenticated account.

What it is

Sophos Web Appliance before 3.8.2 fails to properly restrict the Change Password dialog box (change_password), letting a remote authenticated user change the admin password with a crafted request. Because the admin account controls the appliance, this is a full compromise of the device's management plane.

Impact

An attacker with any authenticated account can reset the administrator password and take over the appliance, gaining full administrative control. Integrity and availability are fully impacted; confidentiality is not per the CVSS vector.

Attack surface

Reached over the network through the web management interface's change_password function. It requires a valid authenticated session but no user interaction beyond sending the crafted request.

Exploitation

Public exploit code exists (Exploit-DB and SecurityFocus references tagged Exploit), and EPSS is 0.6032 (99th percentile), indicating high likelihood of exploitation. It is not listed in CISA KEV.

What to do

• Upgrade Sophos Web Appliance to 3.8.2 or later, per the vendor knowledge base advisory.
• If immediate patching is not possible, restrict management interface access to trusted administrative networks.
• Audit and remove unnecessary authenticated accounts that could reach the change_password function.
• Monitor and rotate administrator credentials on any appliance that ran a vulnerable version.

Detection

• Alert on change_password requests originating from non-administrative accounts or unexpected source IPs.
• Review appliance audit logs for administrator password changes outside approved change windows.
• Hunt for use of the public Exploit-DB proof-of-concept against the management interface.
• Correlate unexpected admin logins or configuration changes following a password reset event.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.