CVE-2022-1040
Sophos Firewall Authentication Bypass Vulnerability
Description
CVE-2022-1040 is an authentication bypass vulnerability in the User Portal and Webadmin interfaces of Sophos Firewall that allows a remote attacker to bypass authentication and gain unauthorized access to the management console. Once authentication is bypassed, the attacker can potentially execute arbitrary code on the firewall device. It was added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. With an EPSS score of 97.0% (99.8th percentile), this vulnerability is extensively targeted by threat actors.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sophos | sfos | <= 18.5.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/168046/Sophos-XG115w-Firewall-17.0.10-MR-10-Authentication-Bypass.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/51006(Exploit, Third Party Advisory, VDB Entry)
- https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-1040(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
Improper authentication occurs when an application does not properly verify the identity of a user before granting access to protected resources. In CVE-2022-1040, the Sophos Firewall's User Portal and Webadmin components contain an authentication bypass flaw that allows attackers to access the management interface without valid credentials. For more details, see CWE-287.
Impact Analysis
Exploitation of this vulnerability grants attackers complete administrative access to the Sophos Firewall, which typically serves as the primary security boundary for an organization's network. An attacker who controls the firewall can intercept and inspect all network traffic, modify firewall rules to allow unauthorized access, create VPN connections for persistent backdoor access, and disable security features. The strategic position of firewalls at the network perimeter means that their compromise provides attackers with the ideal vantage point for reconnaissance, data exfiltration, and further intrusion into the internal network.
Exploit Maturity
CVE-2022-1040 was added to CISA's KEV catalog on March 31, 2022, confirming active exploitation in targeted attacks. The EPSS score of 97.0% (99.8th percentile) reflects widespread exploitation activity. Sophos confirmed that the vulnerability was being exploited in targeted attacks against specific organizations in the South Asia region. The exploitation was attributed to sophisticated threat actors capable of leveraging firewall compromise for persistent network access.
Remediation
- Apply the Sophos Firewall hotfix or update to a patched firmware version immediately, as required by CISA's KEV catalog. Sophos released emergency patches for this vulnerability.
- If the hotfix cannot be applied immediately, restrict access to the User Portal and Webadmin interfaces from untrusted networks.
- Enable the "Allow automatic installation of hotfixes" setting in Sophos Firewall to receive critical security updates automatically.
- Review firewall configuration and logs for signs of unauthorized access or configuration changes.
- Implement out-of-band management for firewall administration, ensuring the management interface is only accessible through a dedicated management network.
Technical Details
The vulnerability resides in the authentication handling logic of both the User Portal and Webadmin web interfaces of Sophos Firewall. A flaw in the authentication validation process allows a remote attacker to craft specific requests that bypass the authentication mechanism entirely. Once authentication is bypassed, the attacker gains access to the full administrative interface and can perform any actions available to legitimate administrators. This includes modifying firewall rules, configuring VPN access, and executing commands on the underlying operating system. The vulnerability affects the web-facing components and can be exploited by any attacker who can reach the User Portal or Webadmin interface over the network.
Frequently Asked Questions
What is CVE-2022-1040?
CVE-2022-1040 is an authentication bypass vulnerability in Sophos Firewall's User Portal and Webadmin interfaces. It allows remote attackers to bypass the login mechanism and gain full administrative access to the firewall without valid credentials.
Which Sophos products are affected?
The vulnerability affects Sophos Firewall versions prior to v18.5 MR3 (18.5.3). Both the User Portal and Webadmin interfaces are affected. Sophos released hotfixes that are automatically applied if automatic updates are enabled.
Can this vulnerability be exploited from the internet?
Yes, if the User Portal or Webadmin interface is accessible from the internet, the vulnerability can be exploited remotely. Many organizations expose the User Portal for remote VPN access, which makes this attack vector particularly relevant.
What should I do if my firewall may have been compromised?
If compromise is suspected, apply the hotfix immediately, change all administrative credentials, review firewall rules and VPN configurations for unauthorized changes, examine logs for suspicious activity, and consider rebuilding the firewall from a clean installation if compromise is confirmed.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.