CVE-2022-3226: Command Injection
Published Dec 1, 2022
·Updated
An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA.
Affected Software
4 affected components
Sophos Xg Firewall Firmware<=19.0
Sophos XG Firewall
All of the following
Sophos Xg Firewall Firmware<=19.0
Sophos XG Firewall
Event History
Dec 1, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the vulnerability ID for this OS command injection vulnerability?
The vulnerability ID for this OS command injection vulnerability is CVE-2022-3226.
2
What is the title of this vulnerability?
The title of this vulnerability is 'An OS command injection vulnerability allows admins to execute code via SSL VPN configuration upload.'
3
How can admins exploit this vulnerability?
Admins can exploit this vulnerability by executing code through SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA.
4
Which software versions are affected by this vulnerability?
Sophos Firewall releases older than version 19.5 GA are affected by this vulnerability.
5
What is the severity and CVSS score of this vulnerability?
The severity of this vulnerability is high, with a CVSS score of 7.2.