Sophos Firewall carries a high-severity vulnerability that’s being actively exploited in the wild, the company has confirmed, urging system admins to apply the patch, or the workaround, as quickly as possible.
In an official announcement, the company said that the threat actor abusing the flaw focuses on a specific type of companies for its victims.
“Sophos has observed this vulnerability being used to target a small set of specific organizations, primarily in the South Asia region,” Sophos said. “We have informed each of these organizations directly. Sophos will provide further details as we continue to investigate.”
Remote code execution
The vulnerability was discovered in the User Portal and Webadmin. Tracked as CVE-2022-3236, the flaw allows threat actors to remotely execute code. The company has already released a fix, that should be applied automatically to most users. By default, the feature of automatic updates is enabled, so unless system admins deliberately turned it off, they should be fine.
Those that should pay extra care are those that have the feature turned off, or those who are using older versions of Sophos Firewall. These would need to upgrade the software, first.
System admins that are unable to apply the patch at this time can also use the workaround – making sure the User Portal and Webadmin aren’t exposed to WAN.
“Disable WAN access to the User Portal and Webadmin by following device access best practices and instead use VPN and/or Sophos Central (preferred) for remote access and management,” Sophos said.
This is at least the third time this year Sophos Firewall made headlines for all the wrong reasons. In April this year, the company announced patching a flaw that allowed threat actors to remotely execute any code, including viruses and malware, on an endpoint (opens in new tab) running its firewall software, and in late June, it fixed CVE-2022-1040 (authentication bypass flaw that allows arbitrary code execution).
Via: BleepingComputer (opens in new tab)
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba