CVE DatabaseCVE-2022-1040

Updated 2026-06-17한국어 권고문 →

CVE-2022-10409.8/CRITICALCISA KEV

Sophos Firewall User Portal and Webadmin Authentication Bypass Leading to RCE (CVE-2022-1040)

⚡ Jump to Patch

Affected Vendors

sophos

Affected Components

firewall

Published Date

2022-03-25

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

99.8%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Sophos Firewall v18.5 MR3 and older versions with User Portal and Webadmin interfaces enabled.

Impact

Remote attackers can bypass authentication to execute arbitrary code, potentially leading to full firewall compromise and internal network intrusion.

Mitigation

Apply the official firmware patches immediately and disable WAN-side access to the Webadmin and User Portal interfaces.

Affected Products & Version Scope

Sophos Firewall v18.5 MR3 and all prior versions (specifically when Webadmin or User Portal is exposed to the WAN)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Sophos has released hotfixes and firmware updates to address this vulnerability. Ensure that automatic updates are enabled, or manually verify and upgrade the firmware version via the CLI.

bash

# Check current firmware version and hotfix status via Sophos CLI
console> show version
# Ensure the system is running SFOS 18.5 MR4 or has the latest hotfix applied

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, disable WAN access to the User Portal and Webadmin interfaces. Restrict management access exclusively to trusted internal LAN or VPN zones.

bash

# Disable WAN-side access to Webadmin and User Portal via Device Access settings
# Navigate to 'Administration' -> 'Device Access' in the GUI and uncheck HTTPS and User Portal for the WAN zone.
# Alternatively, restrict access using local ACLs via CLI:
console> system appliance_access enable

3. Log Audit & IoC Verification Commands

Inspect the firewall logs for signs of unauthorized access or unusual web requests targeting the management interfaces.

bash

# Search for anomalous patterns or exceptions in the web server and controller logs
grep -E 'userportal|webadmin' /var/tslog/uwsgi.log | grep -i 'exception'
grep -E 'csc' /var/tslog/csc.log | grep -i 'invalid session'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active in-the-wild exploitation, immediately disable WAN access to management portals and apply the latest Sophos security patches.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

CVE-2022-1040 is a critical authentication bypass vulnerability located in the User Portal and Webadmin components of Sophos Firewall. The root cause lies in insufficient validation and logical flaws within the request handling and session management mechanisms, allowing unauthenticated remote attackers to access administrative endpoints.

2. Exploitation Mechanics & Attack Scenario

An attacker sends crafted HTTP requests to the exposed Webadmin or User Portal ports. By exploiting the parsing logic of the internal web server, the attacker bypasses the authentication filter. Once bypassed, the attacker gains access to administrative APIs, enabling them to execute arbitrary commands with root privileges on the underlying operating system.

3. Infrastructure & Business Impact

As firewalls serve as the primary perimeter defense, compromise of this device grants attackers a foothold inside the trusted network. This can lead to lateral movement, credential theft, and full infrastructure compromise. Given its inclusion in the CISA KEV and an extremely high EPSS score, active exploitation poses an immediate threat to business continuity.

Official Vendor Advisories & References

NVD Original English Description

An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.

http://packetstormsecurity.com/files/168046/Sophos-XG115w-Firewall-17.0.10-MR-10-Authentication-Bypass.html

Source: security-alert@sophos.com · Exploit, Third Party Advisory, VDB Entry

https://www.exploit-db.com/exploits/51006

Source: security-alert@sophos.com · Exploit, Third Party Advisory, VDB Entry

https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce

Source: security-alert@sophos.com · Mitigation, Vendor Advisory

http://packetstormsecurity.com/files/168046/Sophos-XG115w-Firewall-17.0.10-MR-10-Authentication-Bypass.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

https://www.exploit-db.com/exploits/51006

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce

Source: af854a3a-2127-422b-91ae-364da2661108 · Mitigation, Vendor Advisory

Frequently Asked SecOps Questions (CVE-2022-1040)

FAQ

Q1. How critical is CVE-2022-1040 and is it actively exploited in the wild?

CVE-2022-1040 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2022-1040?

Primary impacted vendors include sophos across firewall. Scope summary: Sophos Firewall v18.5 MR3 and all prior versions (specifically when Webadmin or User Portal is exposed to the WAN)

Q3. What temporary mitigations or workarounds exist for CVE-2022-1040 before patching?

[Mitigation] Apply the official firmware patches immediately and disable WAN-side access to the Webadmin and User Portal interfaces. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION