CVE-2023-1671

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
Sophos	Sophos Web Appliance	>= unspecified, < 4.3.10.4

References

http://packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rceVendor Advisory
http://packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rceVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-1671US Government Resource

Timeline

Published: Apr 4, 2023
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 16, 2023
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-16725.3A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where CVE-2023-16749.8A vulnerability was found in SourceCodester School Registration and Fee System 1.0 and classified as critical. This issue affects some unkno CVE-2023-16759.8A vulnerability was found in SourceCodester School Registration and Fee System 1.0. It has been classified as critical. Affected is an unkno CVE-2023-16767.8A vulnerability was found in DriverGenius 9.70.0.346. It has been declared as critical. Affected by this vulnerability is the function 0x9C4 CVE-2023-16775.5A vulnerability was found in DriverGenius 9.70.0.346. It has been rated as problematic. Affected by this issue is the function 0x9c40a0c8/0x CVE-2023-16787.8A vulnerability classified as critical has been found in DriverGenius 9.70.0.346. This affects the function 0x9C40A0D8/0x9C40A0DC/0x9C40A0E0 CVE-2023-16797.8A vulnerability classified as critical was found in DriverGenius 9.70.0.346. This vulnerability affects the function 0x9C406104/0x9C40A108 i CVE-2023-16807.5A vulnerability, which was classified as problematic, has been found in Xunrui CMS 4.61. This issue affects some unknown processing of the f CVE-2023-16817.5A vulnerability, which was classified as problematic, was found in Xunrui CMS 4.61. Affected is an unknown function of the file /config/myfi CVE-2023-16827.5A vulnerability has been found in Xunrui CMS 4.61 and classified as problematic. Affected by this vulnerability is an unknown functionality CVE-2023-16837.5A vulnerability was found in Xunrui CMS 4.61 and classified as problematic. Affected by this issue is some unknown functionality of the file CVE-2023-16849.8A vulnerability was found in HadSky 7.7.16. It has been classified as problematic. This affects an unknown part of the file upload/index.php