CVE-2022-3236
Sophos Firewall Code Injection Vulnerability
Description
CVE-2022-3236 is a code injection vulnerability in the User Portal and Webadmin interfaces of Sophos Firewall that allows an unauthenticated remote attacker to execute arbitrary code on the appliance. The vulnerability stems from improper input sanitization in the web management interfaces, enabling attackers to inject and execute code on the underlying operating system. With an EPSS score of 92.40% (99.73rd percentile), this Sophos Firewall vulnerability is highly likely to be exploited. CISA added CVE-2022-3236 to the KEV catalog on September 23, 2022.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sophos | firewall | <= 19.0.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-3236(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
CVE-2022-3236 is a code injection vulnerability in the Sophos Firewall management interfaces. The User Portal and Webadmin components fail to properly sanitize user-supplied input before using it in code execution contexts, allowing remote attackers to inject and execute arbitrary code on the firewall appliance.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2022-3236 is a critical code injection vulnerability that allows unauthenticated remote code execution on Sophos Firewall appliances through the User Portal and Webadmin interfaces. The vulnerability is remotely exploitable with low complexity and requires no authentication or user interaction. Confidentiality, integrity, and availability are critically impacted: a compromised firewall grants the attacker control over all network traffic passing through the device, the ability to modify security policies, access to VPN credentials and certificates, and a pivot point into the protected internal network. The EPSS score of 92.40% confirms very high exploitation probability, and targeting a network security appliance amplifies the impact significantly.
Exploit Maturity
CISA confirmed active exploitation of CVE-2022-3236 and added it to the KEV catalog on September 23, 2022, with a remediation deadline of October 14, 2022. Sophos reported that the vulnerability was being exploited in targeted attacks against a small set of specific organizations, primarily in the South Asia region. The EPSS score of 92.40% (99.73rd percentile) indicates very high exploitation probability. The ransomware association is classified as unknown. Sophos released a hotfix that is automatically applied to devices with automatic updates enabled.
Remediation
- Apply Sophos hotfix: Verify that the automatic hotfix for CVE-2022-3236 has been applied. For Sophos Firewall v19.0 MR1 (19.0.1) and older, manually update to the latest firmware if automatic updates are disabled.
- Restrict management interface access: Ensure the User Portal and Webadmin interfaces are not exposed to the internet. Configure access restrictions to limit management access to trusted internal IP addresses only.
- Disable WAN-facing management interfaces: If the User Portal must be internet-accessible, consider using Sophos Central for remote management instead of exposing the local web interface.
- Monitor for indicators of compromise: Review Sophos Firewall logs for unusual authentication attempts, unexpected configuration changes, and signs of webshell deployment.
- Implement network segmentation: Ensure the firewall management interfaces are on a dedicated management network segment isolated from general user traffic.
Technical Details
CVE-2022-3236 targets the User Portal and Webadmin web interfaces of Sophos Firewall, which handle user authentication and device administration respectively. The code injection vulnerability exists in how these interfaces process user-supplied input, where insufficient input sanitization allows specially crafted requests to inject code that is executed by the server-side application framework. The vulnerability is accessible without authentication through the User Portal interface, which is often exposed to the internet for VPN and user self-service functionality. Exploitation results in code execution with the privileges of the firewall application, which typically has root-level access to the underlying operating system. Sophos reported targeted exploitation against organizations in the South Asia region, suggesting initial use by sophisticated threat actors.
Frequently Asked Questions
Is CVE-2022-3236 being actively exploited?
Yes, CVE-2022-3236 has been actively exploited. Sophos confirmed targeted attacks against organizations primarily in South Asia. CISA added it to the KEV catalog on September 23, 2022, and the EPSS score of 92.40% indicates very high exploitation probability.
What products are affected by CVE-2022-3236?
CVE-2022-3236 affects Sophos Firewall versions prior to the hotfix release, including v19.0 MR1 and older. The User Portal and Webadmin interfaces are the affected components.
How do I fix CVE-2022-3236?
Verify that the automatic hotfix from Sophos has been applied. Update to the latest Sophos Firewall firmware, and restrict management interface access to trusted networks only.
How severe is CVE-2022-3236?
CVE-2022-3236 is a critical code injection vulnerability with an EPSS score of 92.40% (99.73rd percentile). It allows unauthenticated remote code execution on Sophos Firewall appliances, potentially compromising the entire network security perimeter.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.