CVE-2023-1671

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - security-alert@sophos.com

Published

2023-04-04

Last modified

2025-10-21

Known exploited (CISA KEV)

since 2023-11-16, action due 2023-12-07: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

CWE-77

Affected products

• Sophos Web Appliance (Sophos)
• Web Appliance (Sophos)

References

• http://packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.html
• https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-1671