CVE-2022-3236

What it actually does

CVE-2022-3236 is an unauthenticated remote code injection vulnerability in Sophos Firewall User Portal and Webadmin interfaces. When either interface is reachable over the network, an attacker can send crafted requests that cause the firewall to execute attacker-controlled code with the privileges of the vulnerable service. Because the affected component runs on the security appliance itself, successful exploitation can compromise confidentiality, integrity, and availability of the firewall and may allow configuration tampering, credential theft, traffic interception, persistence, or use of the device as a foothold into internal networks.

Why it matters to the business

This is a critical perimeter-device vulnerability with active exploitation observed in the wild and inclusion in CISA KEV, meaning exposed Sophos Firewall management or portal interfaces should be treated as high-risk even if no compromise is currently known. A compromised firewall can disrupt internet connectivity, VPN access, branch connectivity, and security enforcement, while also giving an attacker a privileged position to observe or manipulate network traffic. The CISA remediation deadline was 2022-10-14, so any remaining vulnerable deployment is significantly overdue and should be prioritized for emergency remediation.

How an attack unfolds

An attacker first identifies Sophos Firewall systems with the User Portal or Webadmin interface exposed, commonly through internet-wide scanning or targeted reconnaissance. They then send a specially crafted HTTP or HTTPS request to the vulnerable interface that injects code into the server-side processing path. If successful, the firewall executes the injected payload without requiring authentication or user interaction. The attacker may then run commands, deploy scripts or web-accessible payloads, collect configuration data, harvest credentials or VPN material, create or modify administrative access, alter firewall rules, or use the appliance to pivot toward protected networks. Because this vulnerability has been exploited in the wild, responders should assume that internet-exposed vulnerable systems may have been probed or attacked before patching.

How to fix it

Upgrade Sophos Firewall to a fixed release immediately. Sophos identifies versions v19.0 MR1 and older as affected; upgrade to v19.0 MR2 or later, or to the latest supported Sophos Firewall release available for the appliance. Ensure Sophos automatic hotfix installation is enabled and confirm the relevant vendor hotfix has been applied where a full version upgrade is not immediately possible. As an immediate mitigation, disable WAN or untrusted-network access to the User Portal and Webadmin interfaces, restrict management access to trusted administrative networks or VPN-only paths, and enforce strong administrative authentication. After patching, review firewall configuration, administrator accounts, VPN settings, certificates, NAT/firewall rules, scheduled tasks, and any recently modified system files for signs of tampering.

How to confirm the fix worked

Confirm the appliance is running a fixed Sophos Firewall version, preferably v19.0 MR2 or later or the latest supported release. Verify automatic hotfixes are enabled and that the device reports no pending security hotfixes. From an untrusted network, confirm the User Portal and Webadmin interfaces are not reachable unless explicitly required and protected by strict source-IP controls. Review exposure using external scanning for Sophos Firewall Webadmin, commonly on TCP/4444, and User Portal, commonly on HTTPS ports configured by the administrator. Validate that administrative accounts, firewall rules, VPN configuration, certificates, and object definitions have not changed unexpectedly since the vulnerable period. Where compromise is suspected, preserve logs and perform appliance-specific incident response before factory reset or replacement decisions.

Typical attack path

1. Scan for Sophos Firewall User Portal or Webadmin interfaces exposed to the internet or other untrusted networks.
2. Fingerprint the appliance version or infer vulnerability based on exposed service behavior.
3. Send a crafted unauthenticated request to the User Portal or Webadmin endpoint to trigger code injection.
4. Execute commands or stage a payload on the firewall appliance.
5. Collect firewall configuration, administrative credentials, VPN information, certificates, or session material.
6. Establish persistence or create/modify administrative access if possible.
7. Use the firewall position to monitor traffic, alter rules, disrupt services, or pivot into internal networks.

How to detect it

Investigate whether the Sophos Firewall User Portal or Webadmin interface was exposed during the vulnerable period and review logs around the publication and patch dates, as well as any periods of internet exposure. Relevant sources include Sophos Firewall system logs, admin/audit logs, web server or reverse-proxy logs if present, authentication logs, configuration-change history, VPN logs, endpoint/network telemetry observing the firewall, and upstream firewall or NetFlow records. Look for unauthenticated HTTP requests to User Portal or Webadmin followed by command-execution behavior, unexpected child processes, suspicious file creation, new or modified administrator accounts, unexpected configuration exports, firewall rule changes, certificate or VPN changes, and outbound connections from the firewall to unfamiliar hosts. Because exploitation has been observed in the wild, include retrospective searches for scanning followed by requests containing shell metacharacters, command names, encoded payloads, or attempts to write into temporary or web-accessible directories. If logs are missing or rotated, use configuration backups, account history, hotfix/version history, and network telemetry to reconstruct exposure and identify anomalous changes.

• Sophos Firewall v19.0 MR1
• Sophos Firewall v19.0 MR1 and older
• TCP/4444
• User Portal
• Webadmin
• /webadmin
• /userportal
• /bin/sh
• /bin/bash
• /tmp/
• /var/tmp/
• wget
• curl
• chmod +x
• bash -c
• sh -c
• python -c
• perl -e
• nc
• netcat
• ;id
• ;uname
• `id`
• $(id)
• /etc/passwd

What your security team should do

• Immediately identify all Sophos Firewall appliances and determine whether any run v19.0 MR1 or older.
• Prioritize emergency upgrade to v19.0 MR2 or later, or the latest supported Sophos Firewall release, especially for internet-facing appliances.
• Disable or tightly restrict User Portal and Webadmin access from the internet and other untrusted networks.
• Confirm Sophos automatic hotfix installation is enabled across all appliances.
• Treat any previously internet-exposed vulnerable appliance as potentially compromised and perform threat hunting before closing the incident.
• Review administrator accounts, authentication settings, VPN users, certificates, firewall/NAT rules, and recent configuration backups for unauthorized changes.
• Search historical web, admin, system, and appliance logs for suspicious unauthenticated requests, command-execution artifacts, unexpected file writes, and outbound connections from the firewall.
• If exploitation is suspected, rotate firewall administrator credentials, VPN credentials, API keys, and certificates that may have been accessible from the appliance.
• Monitor for unusual outbound connections originating from the firewall appliance, especially to unfamiliar VPS, dynamic DNS, or recently registered domains.
• Document completion against CISA KEV expectations; the remediation due date for federal agencies was 2022-10-14.