Read the docs
TI-2022-03397 Aliases CVE-2022-3696GHSA-x8cr-3jh5-wvwp

Code injection in Sophos Firewall

Priority LOW 36CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0125 69th percentileScored 2026-11-07
Fix Fixed Sophos Firewall (Sophos): 19.5 GA, 19.0 MR2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SophosSophos Firewallbefore 19.5 GA; before 19.0 MR219.5 GA, 19.0 MR2Patch availableCNA
  • Sophos Firewall VendorSophos Affected before 19.5 GA; before 19.0 MR2 Fixed in 19.5 GA, 19.0 MR2 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:sophos:xg_firewall_firmware:*:*:*:*:*:*:*:*up to 19.0VulnerableSophos
cpe:2.3:h:sophos:xg_firewall:-:*:*:*:*:*:*:*not specified by NVDRunning onSophos
  • cpe:2.3:o:sophos:xg_firewall_firmware:*:*:*:*:*:*:*:* Versions up to 19.0 Vulnerable ·Sophos
  • cpe:2.3:h:sophos:xg_firewall:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sophos

Remediation

  • Fix · CNA Sophos Firewall (Sophos) Fixed in 19.5 GA, 19.0 MR2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Sophos Firewall 19.0 MR2, 19.5 GA

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3696
  2. 2026-10-03 Alias added: GHSA-x8cr-3jh5-wvwp

References

Advisory 1

  • TI-2020-11847 Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-12208 A SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall… CVSS 3.1CRITICAL 9.8
  • TI-2020-13130 Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through… CVSS 3.1HIGH 8.8
  • TI-2022-03413 Code injection in Sophos Firewall CVSS 3.1HIGH 8.8
  • TI-2022-03410 Cross-site scripting in Sophos Firewall CVSS 3.1HIGH 8.4
  • TI-2022-02981 OS command injection in Sophos Firewall CVSS 3.1HIGH 7.2
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences