Sophos SG UTM Remote Code Execution Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-25
• EPSS: 97% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11

CISA: A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 15 Apr 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.htmlExploitThird Party AdvisoryVDB Entry
• community.sophos.com/b/security-blogNot ApplicableVendor Advisory
• community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve…Vendor Advisory
• cwe.mitre.org/data/definitions/78.htmlTechnical Description
• www.secpod.com/blog/remote-code-execution-in-sophos-utmExploitThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource