Sophos on Friday announced the rollout of urgent patches for a critical authentication bypass vulnerability in the web portal of its Sophos Firewall product.
Reported by an external researcher via the Sophos bug bounty program, the vulnerability is tracked as CVE-2022-1040 and impacts Sophos Firewall v18.5 MR3 (18.5.3) and older releases.
The issue, the security solutions provider explains, can be exploited by a remote attacker to achieve code execution on a vulnerable system.
[ READ: Details Disclosed for Critical Vulnerability in Sophos Appliances ]
“An authentication bypass vulnerability allowing remote code execution was discovered in the User Portal and Webadmin of Sophos Firewall and responsibly disclosed to Sophos,” the company said in an advisory.
Sophos announced the availability of hotfixes for multiple Firewall versions, including 17.0, 17.5, 18.0, and 18.5. In addition, Sophos included a full patch in version 19 and v18.5 MR4 of the security product.
Versions v17.5 MR12 through MR15, v18.0 MR3 and MR4, and v18.5 GA of the Sophos Firewall, which have already reached End-of-Life (EOL) and are no longer supported, received hotfixes as well.
Related: Malware Delivered to Sophos Firewalls via Zero-Day Vulnerability
Related: Critical Flaw in Sophos Cyberoam Appliances Allows RCE
More from Ionut Arghire
- Pharmaceutical Giant Eisai Takes Systems Offline Following Ransomware Attack
- North Korean Hackers Blamed for $35 Million Atomic Wallet Crypto Theft
- Cisco Patches Critical Vulnerability in Enterprise Collaboration Solutions
- Android’s June 2023 Security Update Patches Exploited Arm GPU Vulnerability
- US, Israel Provide Guidance on Securing Remote Access Software
- Blumira Raises $15 Million for SMB-Tailored XDR Platform
- KeePass Update Patches Vulnerability Exposing Master Password
- Google Workspace Gets Passkey Authentication
Latest News
- Consolidate Vendors and Products for Better Security
- Pharmaceutical Giant Eisai Takes Systems Offline Following Ransomware Attack
- Vulnerabilities in Honda eCommerce Platform Exposed Customer, Dealer Data
- North Korean Hackers Blamed for $35 Million Atomic Wallet Crypto Theft
- Cisco Patches Critical Vulnerability in Enterprise Collaboration Solutions
- Barracuda Urges Customers to Replace Hacked Email Security Appliances
- Android’s June 2023 Security Update Patches Exploited Arm GPU Vulnerability
- BBC, British Airways, Novia Scotia Among First Big-Name Victims in Global Supply-Chain Hack
