CVE-2017-6182

CRITICAL

Sophos Web Appliance < 4.3.1.2 - Remote Command Injection via Report Generation Functions

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-6182. PoCs published by xort.

AI-analyzed exploit summary This Metasploit module exploits a remote command injection vulnerability in Sophos Web Appliance <= 4.3.0.2 via unsanitized JSON input in the reporting interface. It authenticates, injects commands into the 'trafficType' parameter, and either executes a specified command or deploys a payload for a reverse shell.

Description

In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injection via functions, aka NSWA-1304.

Exploits (1)

exploitdb WORKING POC VERIFIED

by xort · rubywebappsjson

https://www.exploit-db.com/exploits/42332

View Code ZIP pw:eip

This Metasploit module exploits a remote command injection vulnerability in Sophos Web Appliance <= 4.3.0.2 via unsanitized JSON input in the reporting interface. It authenticates, injects commands into the 'trafficType' parameter, and either executes a specified command or deploys a payload for a reverse shell.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Sophos Web Appliance <= 4.3.0.2

Auth required

Prerequisites: Valid credentials for the Sophos Web Appliance · Network access to the target device

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4

Core References

Release Notes, Vendor Advisory x_refsource_confirm

http://wsa.sophos.com/rn/swa/concepts/ReleaseNotes_4.3.1.2.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/97261

Exploit, Third Party Advisory exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/42332/

Vendor Advisory x_refsource_confirm

https://community.sophos.com/products/web-appliance/b/blog/posts/release-of-swa-v4-3-1-2

Scores

CVSS v3 9.8

EPSS 0.1656

EPSS Percentile 96.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-78

Status published

Products (1)

sophos/web_appliance < 4.3.1.1

Published Mar 30, 2017

Tracked Since Feb 18, 2026