Vulnerability record · CVE-2022-1040 · published 25 March 2022
CVE-2022-1040: Sophos Firewall auth bypass in User Portal and Webadmin leads to RCE
Sophos · Sfos
Sophos Firewall v18.5 MR3 and older contain an authentication bypass in the User Portal and Webadmin that lets a remote attacker execute code. The flaw is remotely reachable without credentials or user interaction, and public exploit code exists, making it a serious perimeter risk.
Description
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated remote code execution on an internet-facing security device, with public exploits and KEV listing, warrants immediate patching.
What it is
Sophos Firewall v18.5 MR3 and older contain an authentication bypass in the User Portal and Webadmin that lets a remote attacker execute code. The flaw is remotely reachable without credentials or user interaction, and public exploit code exists, making it a serious perimeter risk.
Impact
An unauthenticated attacker can bypass authentication and execute arbitrary code on the firewall, gaining full control of the device and its traffic-handling position.
Attack surface
Reachable over the network via the User Portal and Webadmin interfaces; the CVSS vector shows no privileges required and no user interaction.
Exploitation
Listed in CISA KEV since 2022-03-31 with a 30-day EPSS probability near 0.998, and references include Exploit-tagged entries on Packet Storm and Exploit-DB.
What to do
- Apply the Sophos vendor update for SFOS per advisory sophos-sa-20220325-sfos-rce; upgrade beyond v18.5 MR3.
- Restrict network access to the User Portal and Webadmin to trusted management networks only.
- Disable or block external exposure of the User Portal and Webadmin where not required.
- Review firewall configuration and logs for unauthorized changes after patching.
- Monitor vendor advisory and CISA KEV guidance for any follow-up actions.
Detection
- Hunt firewall and web logs for anomalous requests to User Portal and Webadmin endpoints from untrusted sources.
- Alert on unexpected administrative logins, new admin accounts, or configuration changes on Sophos Firewall.
- Monitor for outbound connections or process activity on the firewall consistent with post-exploitation.
- Correlate network telemetry for scanning or exploitation attempts against the management interfaces.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2022-1040 to the Known Exploited Vulnerabilities catalog on 31 March 2022 as "Sophos Firewall Authentication Bypass Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 21 April 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://packetstormsecurity.com/files/168046/Sophos-XG115w-Firewall-17.0.10-MR-10-Authentication-Bypass.html | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/51006 | ExploitThird Party AdvisoryVDB Entry |
| https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce | MitigationVendor Advisory |
| http://packetstormsecurity.com/files/168046/Sophos-XG115w-Firewall-17.0.10-MR-10-Authentication-Bypass.html | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/51006 | ExploitThird Party AdvisoryVDB Entry |
| https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce | MitigationVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-1040 | US Government Resource |
Track CVE-2022-1040 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-1040), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
