Remote Code Execution Vulnerability in Sophos Web Appliance
CVE-2014-2850

Currently unrated

Key Information:

Vendor
Sophos
Vendor
CVE Published:
11 April 2014

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 70%

Summary

The network interface configuration page of Sophos Web Appliance prior to version 3.8.2 is vulnerable to exploitation, allowing remote administrators to execute arbitrary commands due to the improper handling of input parameters. Attackers can inject shell metacharacters in the address parameter, potentially compromising the system's integrity and granting unwanted access to sensitive functionalities. It is crucial for organizations to apply the necessary updates to mitigate the associated risks.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

References

EPSS Score

70% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability Reserved

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

.