CVE-2022-1040
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker...
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
- Record
CVE-2022-1040- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2022-24387
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
- Record
EUVD-2022-24387- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9gcv-6rm7-vw3w
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker...
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
- Record
GHSA-9gcv-6rm7-vw3w- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
CISA KEV No score
Sophos Firewall Authentication Bypass Vulnerability
An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.
- Record
CVE-2022-1040- Weakness
- CWE-158
- Updated
- 2026-11-02
NVD
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
- Record
CVE-2022-1040- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | killvxk/CVE-2022-1040 | 2022-05-06 |
| Exploit-DB | Sophos XG115w Firewall 17.0.10 MR-10 - Authentication Bypass | 2022-09-02 |
| PoC in GitHub | jam620/Sophos-Vulnerability | 2022-09-25 |
| PoC in GitHub | Keith-amateur/cve-2022-1040 | 2022-10-07 |
| PoC in GitHub | jackson5sec/CVE-2022-1040 | 2022-10-30 |
| PoC in GitHub | michealadams30/CVE-2022-1040 | 2023-01-08 |
| PoC in GitHub | Cyb3rEnthusiast/CVE-2022-1040 | 2023-09-26 |
| PoC in GitHub | xMr110/CVE-2022-1040 | 2024-02-05 |
| Nuclei | Sophos Firewall <=18.5 MR3 - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-1040 is a critical vulnerability (CVSS 9.8) in Sophos Firewall, published March 25, 2022. CISA lists it as known to be exploited, since March 31, 2022. EUVD reports exploitation since March 31, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.8%, the 99th percentile. No source names a fixed version.
References
sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce
packetstormsecurity.com/files/168046/Sophos-XG115w-Firewall-17.0.10-MR-10-Authentication-Bypass.html
exploit-db.com/exploits/51006
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-1040
nvd.nist.gov/vuln/detail/CVE-2022-1040
github.com/advisories/GHSA-9gcv-6rm7-vw3w