Vulnerability record · CVE-2022-3236 · published 23 September 2022
CVE-2022-3236: Sophos Firewall code injection in User Portal and Webadmin
Sophos · Firewall
Sophos Firewall v19.0 MR1 and older contains a code injection flaw in the User Portal and Webadmin interfaces, tracked as CWE-94. A remote, unauthenticated attacker can inject and execute code on the appliance, which sits at the network edge and is therefore a high-value target.
Description
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or interaction required, plus KEV listing and near-certain EPSS score, make this an urgent edge-device compromise risk.
What it is
Sophos Firewall v19.0 MR1 and older contains a code injection flaw in the User Portal and Webadmin interfaces, tracked as CWE-94. A remote, unauthenticated attacker can inject and execute code on the appliance, which sits at the network edge and is therefore a high-value target.
Impact
Successful exploitation gives the attacker code execution on the firewall, enabling full compromise of the device and the traffic and credentials it handles. Because the firewall is a perimeter control, this can expose the protected network.
Attack surface
Reachable over the network through the User Portal and Webadmin interfaces, per the CVSS vector AV:N/AC:L/PR:N/UI:N no authentication or user interaction is required. The record does not specify which ports or endpoints are involved.
Exploitation
It is listed in CISA KEV with a 2022-10-14 remediation due date, and EPSS gives a 30-day probability of about 0.989 at the 99.9th percentile, indicating active exploitation is expected. No ransomware campaign use is recorded.
What to do
- Apply the Sophos update referenced in advisory sophos-sa-20220923-sfos-rce; upgrading past v19.0 MR1 is the primary fix.
- If immediate patching is not possible, restrict access to the User Portal and Webadmin interfaces to trusted management networks only.
- Disable or block external exposure of the User Portal and Webadmin where it is not required.
- Review firewall configuration and logs for signs of tampering after any exposure window.
Detection
- Hunt for unexpected processes or command execution on the firewall appliance, including child processes spawned by web-facing services.
- Review User Portal and Webadmin access logs for anomalous requests or requests from untrusted source addresses.
- Monitor for configuration changes, new admin accounts, or altered firewall rules that were not authorized.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2022-3236 to the Known Exploited Vulnerabilities catalog on 23 September 2022 as "Sophos Firewall Code Injection Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 14 October 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce | Vendor Advisory |
| https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-3236 | US Government Resource |
Track CVE-2022-3236 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-3236), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
