CVE-2022-3226

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Dec 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-322609.8A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application creates temporary us CVE-2022-322617.5A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a misconfigurat CVE-2022-322629.8A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a file upload s CVE-2022-322637.5Pexip Infinity before 28.1 allows remote attackers to trigger a software abort via G.719.CVE-2022-322647.5sys/netinet/tcp_timer.h in FreeBSD before 7.0 contains a denial-of-service (DoS) vulnerability due to improper handling of TSopt on TCP conn CVE-2022-322655.3qDecoder before 12.1.0 does not ensure that the percent character is followed by two hex digits for URL decoding.CVE-2022-322666.4DMA attacks on the parameter buffer used by a software SMI handler used by the driver PcdSmmDxe could lead to a TOCTOU attack on the SMI han CVE-2022-322676.4DMA transactions which are targeted at input buffers used for the SmmResourceCheckDxe software SMI handler cause SMRAM corruption (a TOCTOU CVE-2022-322688.8StarWind SAN and NAS v0.2 build 1914 allow remote code execution. A flaw was found in REST API in StarWind Stack. REST command, which allows CVE-2022-322699.8In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages (displayed by Internet Explo CVE-2022-322709.8In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Traversal, leading to Rem CVE-2022-322719.6In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability. This is an internal URL Protocol used by Rea