Sophos Web Appliance Vulnerability Exploited in the Wild
CISA has flagged the critical CVE-2023-1671 command injection flaw in Sophos Web Appliance for active exploitation, despite the product reaching end-of-life.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the Sophos Web Appliance vulnerability, tracked as CVE-2023-1671, to its Known Exploited Vulnerabilities catalog. The flaw, which carries a critical CVSS score of 9.8, remains a target for attackers despite being disclosed in April 2023.
The vulnerability stems from an input handling error in the device’s 'warn-proceed' handler, allowing unauthenticated remote command execution. By manipulating POST requests sent to the system, attackers can bypass security controls and run arbitrary commands. The issue specifically affects appliance versions released prior to 4.3.10.4.
Although Sophos released a patch earlier this year, the appliance reached its end-of-life in July 2023, leaving systems that were not updated or decommissioned at risk. Security researchers at Picus Security advise organizations to ensure any remaining hardware is removed from public-facing network segments and placed behind restrictive firewall configurations to prevent further exploitation.