CVE-2023-1671: Sophos Web Appliance pre-auth command injection in warn-proceed handler

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8 pre-auth remote code execution, KEV-listed, and EPSS near 1.0 make this an urgent, actively exploited flaw.

What it is

Sophos Web Appliance versions older than 4.3.10.4 contain a command injection flaw in the warn-proceed handler. Because it is reachable without authentication and allows arbitrary code execution, it is a severe remote code execution issue for any exposed appliance.

Impact

An unauthenticated attacker can execute arbitrary commands on the appliance, gaining full control of the device and potentially pivoting into the network it protects.

Attack surface

The flaw is network-reachable via the warn-proceed handler; the CVSS vector shows no privileges required and no user interaction, so it can be triggered directly over the network.

Exploitation

CVE-2023-1671 is listed in CISA KEV with a due date of 2023-12-07, and EPSS is near 1.0 (0.99999), indicating active exploitation and very high likelihood. Public exploit code is referenced via Packet Storm.

What to do

• Upgrade Sophos Web Appliance to version 4.3.10.4 or later immediately.
• If patching is not possible, follow Sophos advisory SA-20230404-SWA-RCE mitigations or discontinue use of the appliance.
• Remove or restrict network exposure of the appliance management and web interfaces to trusted networks only.
• Monitor for and block exploitation attempts targeting the warn-proceed handler at the perimeter.
• Verify no unauthorized changes or persistence on the appliance after patching.

Detection

• Inspect web/proxy logs for requests to the warn-proceed handler with suspicious or shell metacharacter payloads.
• Monitor appliance process execution for unexpected child processes spawned by the web service.
• Alert on outbound connections from the appliance to unknown external hosts.
• Review appliance and system logs for command execution errors or unusual file writes around the time of suspicious requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.