CVE-2022-3236: Sophos Firewall RCE Vulnerability

CVE-2022-3236 Overview

CVE-2022-3236 is a code injection vulnerability affecting the User Portal and Webadmin components of Sophos Firewall version v19.0 MR1 and older. The flaw allows a remote, unauthenticated attacker to execute arbitrary code on the appliance over the network. Sophos published an advisory on September 23, 2022, and CISA added the issue to the Known Exploited Vulnerabilities (KEV) catalog after observing in-the-wild exploitation. The vulnerability is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact

Remote unauthenticated attackers can execute arbitrary code on internet-facing Sophos Firewall appliances, leading to full device compromise and pivot opportunities into protected networks.

Affected Products

• Sophos Firewall v19.0 MR1 (19.0.1) and earlier
• Sophos Firewall User Portal interface
• Sophos Firewall Webadmin management interface

Discovery Timeline

• 2022-09-23 - Sophos publishes security advisory SOPHOS-SA-20220923-SFOS-RCE
• 2022-09-23 - CVE-2022-3236 published to NVD
• 2025-10-27 - Last updated in NVD database

Technical Details for CVE-2022-3236

Vulnerability Analysis

The vulnerability resides in the User Portal and Webadmin web interfaces of Sophos Firewall. An attacker sends a specially crafted HTTP request to a reachable instance and triggers server-side code execution. No authentication is required, and the attack requires no user interaction. Sophos confirmed the issue was being used to target a small set of specific organizations primarily located in the South Asia region at the time of disclosure.

Because both the User Portal and the Webadmin interface are commonly exposed for remote administration and end-user VPN access, internet-facing appliances are directly reachable from untrusted networks. Successful exploitation gives the attacker control over a security perimeter device, enabling traffic inspection bypass, credential theft, and lateral movement into the internal network.

Root Cause

The root cause is improper neutralization of attacker-controlled input that is later evaluated or executed as code by the web application backend, classified as CWE-94. Input passed through the User Portal or Webadmin endpoints is incorporated into a dynamic execution context without adequate validation or sanitization, allowing the attacker to break out of the intended data context and inject executable instructions.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker crafts a malicious HTTP/HTTPS request targeting the User Portal or Webadmin endpoint and delivers it directly to the firewall management or user-facing service. Refer to the Sophos security advisory for the disclosed technical details. No public proof-of-concept exploit code is referenced in the advisory.

Detection Methods for CVE-2022-3236

Indicators of Compromise

• Unexpected outbound connections originating from the firewall appliance to unfamiliar IP addresses
• Anomalous HTTP POST requests to User Portal or Webadmin URIs from external sources
• New or modified administrator accounts on the firewall not created by authorized staff
• Unexplained configuration changes, firewall rule additions, or VPN tunnel modifications

Detection Strategies

• Review Sophos Firewall access and audit logs for User Portal or Webadmin requests from unrecognized source IP addresses, especially during off-hours
• Correlate firewall management plane activity with network flow data to identify unusual east-west or egress traffic from the appliance itself
• Validate appliance integrity against Sophos baseline firmware and apply the hotfix detection markers referenced in the vendor advisory

Monitoring Recommendations

• Forward Sophos Firewall syslog to a centralized SIEM or data lake and alert on authentication anomalies and configuration changes
• Monitor for connections to the User Portal and Webadmin interfaces from outside expected administrative source ranges
• Track CISA KEV catalog updates and align internal vulnerability scanning to flag any appliance still running v19.0 MR1 or earlier

How to Mitigate CVE-2022-3236

Immediate Actions Required

• Verify the running firmware version on every Sophos Firewall appliance and apply the vendor-supplied hotfix or upgrade to a fixed release immediately
• Restrict User Portal and Webadmin exposure so these interfaces are not reachable from the public internet
• Audit administrator accounts, API tokens, and recent configuration changes for signs of unauthorized activity
• Rotate administrator credentials and pre-shared keys on any appliance suspected of exposure prior to patching

Patch Information

Sophos released hotfixes for supported versions of Sophos Firewall and addressed the vulnerability in subsequent releases beyond v19.0 MR1. Customers with the default "Allow automatic installation of hotfixes" setting enabled received the fix automatically. Full remediation details and fixed version mapping are available in the Sophos Security Advisory SOPHOS-SA-20220923-SFOS-RCE. The vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, making prompt patching a federal requirement for in-scope agencies.

Workarounds

• Disable WAN access to the User Portal and Webadmin interfaces and require administrators to connect through a VPN before accessing management services
• Limit source IP addresses permitted to reach the management interfaces using firewall device access rules
• Confirm that the automatic hotfix installation feature is enabled on all appliances to ensure delivery of vendor remediation

# Recommended hardening: restrict management plane exposure
# In Sophos Firewall: Administration > Device Access
# - Uncheck HTTPS and User Portal for the WAN zone
# - Require VPN (SSL VPN or IPsec) for remote admin access
# - Confirm: System Services > Hotfix > Allow automatic installation = ON