CVE-2022-3696

HIGH

Sophos XG Firewall Firmware < 19.0 - Code Injection

Title source: rule

Description

A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA.

References (1)

Scores

CVSS v3 7.2
EPSS 0.0044
EPSS Percentile 62.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-94
Status published

Affected Products (1)

sophos/xg_firewall_firmware < 19.0

Timeline

Published Dec 01, 2022
Tracked Since Feb 18, 2026