Critical · published March 25, 2022
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.
🚨 An authentication bypass in Sophos Firewall? Yikes! A remote attacker can exploit this to execute code without breaking a sweat! 🔥 Think of it as a hotel with a faulty front desk; anyone could walk in and access the management suite without a keycard, just because no one checked their ID. The hotel staff is simply too trusting! An attacker could run any code they want on the firewall, leading to unauthorized access to sensitive data and complete control over the firewall itself. This could result in data breaches, network disruptions, and absolute chaos for the organization!
Think of it as a hotel with a faulty front desk; anyone could walk in and access the management suite without a keycard, just because no one checked their ID. The hotel staff is simply too trusting! This vulnerability allows remote attackers to bypass authentication mechanisms in the User Portal and Webadmin of Sophos Firewall versions v18.5 MR3 and older, allowing arbitrary code execution as if they were authorized users.
An attacker could run any code they want on the firewall, leading to unauthorized access to sensitive data and complete control over the firewall itself. This could result in data breaches, network disruptions, and absolute chaos for the organization! Immediately upgrade to Sophos Firewall version v18.5 MR4 or later to close this gap. Additionally, review and tighten firewall access controls to minimize risk in case of potential exploits. Conduct a security audit to ensure there are no other vulnerabilities lurking around! You've got this! Follow these steps and you'll be a security hero in no time! 🦸