CVE-2022-3713

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Sophos	Sophos Firewall	>= unspecified, < 19.5 GA; >= unspecified, < 19.0 MR2; >= unspecified, < 18.5 MR5

References

https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0Vendor Advisory
https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0Vendor Advisory

Timeline

Published: Dec 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-371309.8In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the cond CVE-2022-371337.5D-link DIR-816 A2_v1.10CNB04.img reboots the router without authentication via /goform/doReboot. No authentication is required, and reboot i CVE-2022-371349.8D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Buffer Overflow via /goform/form2Wan.cgi. When wantype is 3, l2tp_usrname will be decrypte CVE-2022-371375.4PayMoney 3.3 is vulnerable to Stored Cross-Site Scripting (XSS) during replying the ticket. The XSS can be obtain from injecting under "Mess CVE-2022-371389.8Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as Administrator after CVE-2022-371395.4Loan Management System version 1.0 suffers from a persistent cross site scripting vulnerability.CVE-2022-37149.8A vulnerability classified as critical has been found in SourceCodester Online Medicine Ordering System 1.0. Affected is an unknown function CVE-2022-371408.0PayMoney 3.3 is vulnerable to Client Side Remote Code Execution (RCE). The vulnerability exists on the reply ticket function and upload the CVE-2022-371448.8The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attack CVE-2022-371457.5The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTra CVE-2022-371465.3The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users co CVE-2022-371499.8WAVLINK WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability when operating the file adm.cgi. This vu