Pierluigi Paganini
December 13, 2023
Sophos backports the fix for the critical code injection vulnerability CVE-2022-3236 for end-of-life (EOL) firewall firmware versions after discovering that threat actors are actively exploiting the flaw in attacks in the wild.
The security firm reported that this vulnerability is being used in attacks against a small set of specific organizations, primarily in South Asia.
In December 2022, Sophos released security patches to address seven vulnerabilities in Sophos Firewall version 19.5, including some arbitrary code execution bugs. The most severe issue addressed by the security vendor is the flaw CVE-2022-3236.
“A code injection vulnerability allowing remote code execution was discovered in the User Portal and Webadmin.” reads the advisory.
In September Sophos warned of this critical code injection security vulnerability (CVE-2022-3236) affecting its Firewall product which was being exploited in the wild. Sophos confirmed that this vulnerability was being used to target a small set of specific organizations, primarily in the South Asia region.
“The vulnerability was originally fixed in September 2022. In December 2023, we delivered an updated fix after identifying new exploit attempts against this same vulnerability in older, unsupported versions of the Sophos Firewall.” reads the update provided by the vendor.
No action is required if organizations have upgraded their firewalls to a supported firmware version after September 2022.
All the vulnerable devices are running end-of-life (EOL) firmware. We immediately developed a patch for certain EOL firmware versions, which was automatically applied to the 99% of affected organizations that have “accept hotfix” turned on.
Attackers commonly hunt for EOL devices and firmware from any technology vendor, so we strongly recommend that organizations upgrade their EOL devices and firmware to the latest versions.”
In January 2023, researchers from cyber security firm VulnCheck scanned internet-facing Sophos Firewalls and found more than 4,000 firewalls that were too old to receive a hotfix.
Below is the list of remediation included in the advisory:
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, command injection)
