CVE-2023-1671
SO
Sophos Web Appliance
Sophos Web Appliance Command Injection Vulnerability
What it is
Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor notices and references
- www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce
- nvd.nist.gov/vuln/detail/CVE-2023-1671
Description and required action as published by CISA. Full record at NVD.
Other Sophos entries on the list
- CyberoamOS CyberoamOS (CROS) SQL Injection Vulnerability CVE-2020-29574 · Feb 6, 2025
- XG Firewall Sophos XG Firewall Buffer Overflow Vulnerability CVE-2020-15069 · Feb 6, 2025
- Firewall Sophos Firewall Code Injection Vulnerability CVE-2022-3236 · Sep 23, 2022
- Firewall Sophos Firewall Authentication Bypass Vulnerability CVE-2022-1040 · Mar 31, 2022
- SG UTM Sophos SG UTM Remote Code Execution Vulnerability CVE-2020-25223 · Mar 25, 2022
- SFOS Sophos SFOS SQL Injection Vulnerability CVE-2020-12271 · Nov 3, 2021