CVE-2016-9554

CVE-2016-9554 is a high-severity vulnerability in Sophos Web Appliance with a CVSS 3.x base score of 7.2. Its EPSS exploit-prediction score of 24% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-77.

Key facts

Description

The Sophos Web Appliance Remote / Secure Web Gateway server (version 4.2.1.3) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. These vulnerabilities occur in MgrDiagnosticTools.php (/controllers/MgrDiagnosticTools.php), in the component responsible for performing diagnostic tests with the UNIX wget utility. The application doesn't properly escape the information passed in the 'url' variable before calling the executeCommand class function ($this->dtObj->executeCommand). This function calls exec() with unsanitized user input allowing for remote command injection. The page that contains the vulnerabilities, /controllers/MgrDiagnosticTools.php, is accessed by a built-in command answered by the administrative interface. The command that calls to that vulnerable page (passed in the 'section' parameter) is: 'configuration'. Exploitation of this vulnerability yields shell access to the remote machine under the 'spiderman' user account.

Frequently asked questions

What is CVE-2016-9554?
The Sophos Web Appliance Remote / Secure Web Gateway server (version 4.2.1.3) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. These vulnerabilities occur in MgrDiagnosticTools.php (/controllers/MgrDiagnosticTools.php), in the component responsible for performing diagnostic tests with the UNIX wget utility. The application doesn't properly escape the information passed in the 'url' variable before calling the executeCommand class function ($this->dtObj->executeCommand). This function calls exec() with unsanitized user input allowing for remote command injection. The page that contains the vulnerabilities, /controllers/MgrDiagnosticTools.php, is accessed by a built-in command answered by the administrative interface. The command that calls to that vulnerable page (passed in the 'section' parameter) is: 'configuration'. Exploitation of this vulnerability yields shell access to the remote machine under the 'spiderman' user account.
How severe is CVE-2016-9554?
CVE-2016-9554 has a CVSS 3.x base score of 7.2, rated high severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2016-9554 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 24% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2016-9554?
CVE-2016-9554 affects Sophos Web Appliance. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2016-9554?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2016-9554 published?
CVE-2016-9554 was published on 2017-01-28 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Sophos Web Appliance

All CVEs affecting Sophos Web Appliance →

Other CWE-77 (Command Injection) vulnerabilities

Browse all CWE-77 (Command Injection) vulnerabilities →