CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Sophos Firewall User Portal and Webadmin Remote Code Execution (RCE) Vulnerability Advisory (CVE-2022-3236)
[Affected Scope] Sophos Firewall version v19.0 MR1 and older affecting User Portal and Webadmin interfaces
[Impact] Unauthenticated remote attackers can execute arbitrary code and fully compromise the firewall device by sending specially crafted HTTP requests
[Mitigation] Immediately upgrade to the latest firmware version (v19.0 MR2 or later) and disable WAN access to Webadmin and User Portal
Sophos XG Firewall User Portal Buffer Overflow Vulnerability (CVE-2020-15069) Technical Advisory
[Affected Scope] Sophos XG Firewall v17.0, v17.1, and v17.5 (v17.5 MR12 and prior) with Clientless VPN Access feature enabled
[Impact] Unauthenticated remote attackers can execute arbitrary code (RCE) or cause a Denial of Service (DoS) on the firewall via specially crafted HTTP/S requests
[Mitigation] Apply official hotfix HF062020.1, upgrade to the latest firmware, and restrict WAN access to the User Portal and SSL VPN ports