Critical Sophos Firewall Vulnerability Exploited in the Wild
NJCCIC Alert
Original Release Date: 1/19/2023
Summary
Sophos has patched an actively exploited critical vulnerability in its Firewall solutions. CVE-2022-3236 (CVSS v3.1 9.8) is a remote code injection vulnerability in the User Portal and Webadmin impacting Sophos Firewall versions 19.0.1 and older. No action is required for Sophos Firewall customers with the "Allow automatic installation of hotfixes" feature enabled on remediated versions; however, customers that do not have this feature enabled will need to manually apply the hotfix or upgrade to a newer version. Researchers assess that there are approximately 4,000 vulnerable Sophos Firewall instances.
Recommendations
The NJCCIC urges administrators to apply the hotfix or upgrade to a newer version if the automatic installation feature is not enabled after appropriate testing. Further details, patches, and workarounds can be found in the Sophos security advisory.
The NJCCIC is a component organization within the New Jersey Office of Homeland Security and Preparedness. We are the State's one-stop-shop for cyber threat analysis, incident reporting, and information sharing and are committed to making New Jersey more resilient to cyber threats by spreading awareness and promoting the adoption of best practices.
View our Privacy Policy here.
View our Site Index here.