Sophos Firewall — known CVE vulnerabilities

Every CVE whose affected-product data names Sophos Firewall, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (3)

• CVE-2022-3236 — CVSS 9.8 (critical) — actively exploited: A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0…
• CVE-2022-1807 — CVSS 7.2 (high): Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version…
• CVE-2023-5552 — CVSS 7.1 (high): A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in…