CVE-2016-9553: Command Injection
The Sophos Web Appliance (version 4.2.1.3) is vulnerable to two Remote Command Injection vulnerabilities affecting its web administrative interface. These vulnerabilities occur in the MgrReport.php (/controllers/MgrReport.php) component responsible for blocking and unblocking IP addresses from accessing the device. The device doesn't properly escape the information passed in the variables 'unblockip' and 'blockip' before calling the shellexec() function which allows for system commands to be injected into the device. The code erroneously suggests that the information handled is protected by utilizing the variable name 'escapedips' - however this was not the case. The Sophos ID is NSWA-1258.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9553?
CVE-2016-9553 is classified as a high severity vulnerability due to its potential for remote command execution.
How do I fix CVE-2016-9553?
To fix CVE-2016-9553, upgrade the Sophos Web Appliance to a version that addresses this vulnerability.
What software versions are affected by CVE-2016-9553?
CVE-2016-9553 affects the Sophos Web Appliance version 4.2.1.3.
What type of vulnerability is CVE-2016-9553?
CVE-2016-9553 is a remote command injection vulnerability located in the web administrative interface.
Can CVE-2016-9553 be exploited remotely?
Yes, CVE-2016-9553 can be exploited remotely, allowing attackers to execute commands on the vulnerable system.