CVE-2022-1040

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Sophos	Sophos Firewall	>= unspecified, <= 18.5 MR3

References

http://packetstormsecurity.com/files/168046/Sophos-XG115w-Firewall-17.0.10-MR-10-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/51006Exploit, Third Party Advisory, VDB Entry
https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rceMitigation, Vendor Advisory
http://packetstormsecurity.com/files/168046/Sophos-XG115w-Firewall-17.0.10-MR-10-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/51006Exploit, Third Party Advisory, VDB Entry
https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rceMitigation, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-1040US Government Resource

Timeline

Published: Mar 25, 2022
Last modified: Jun 17, 2026
Added to CISA KEV: Mar 31, 2022
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-10418.8In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning.CVE-2022-10428.8In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning.CVE-2022-10438.8A flaw was found in the Linux kernel’s io_uring implementation. This flaw allows an attacker with a local account to corrupt system memory, CVE-2022-10446.5Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1.CVE-2022-10455.4Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0.CVE-2022-10464.8The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which could allow high priv CVE-2022-10476.1The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL before reusing it in CVE-2022-10487.0A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_f CVE-2022-10498.8A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired password CVE-2022-10508.8A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW comma CVE-2022-10515.4The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the c CVE-2022-10525.5Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6.