CVE-2023-1671
Last modified
CVE-2023-1671 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.. CISA has confirmed active exploitation in the wild. EPSS estimates a 100.00% chance of exploitation in the next 30 days.
Description
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
100.0th percentile
Probability of exploitation in the next 30 days. Learn more
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sophos | Web Appliance | < 4.3.10.4 |
References
- http://packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-1671US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2023-1671?
How severe is CVE-2023-1671?
How do I fix CVE-2023-1671?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-1665Improper Restriction of Excessive Authentication Attempts in…9.8
- CVE-2023-1666A vulnerability has been found in SourceCodester Automatic Q…9.8
- CVE-2023-1667A NULL pointer dereference was found In libssh during re-key…6.5
- CVE-2023-1668A flaw was found in openvswitch (OVS). When processing an IP…8.2
- CVE-2023-1669The SEOPress WordPress plugin before 6.5.0.3 unserializes us…7.2
- CVE-2023-1670A flaw use after free in the Linux kernel Xircom 16-bit PCMC…7.8
- CVE-2023-1672A race condition exists in the Tang server functionality for…5.3
- CVE-2023-1673Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
- CVE-2023-1674A vulnerability was found in SourceCodester School Registrat…9.8
- CVE-2023-1675A vulnerability was found in SourceCodester School Registrat…9.8
- CVE-2023-1676A vulnerability was found in DriverGenius 9.70.0.346. It has…7.8
- CVE-2023-1677A vulnerability was found in DriverGenius 9.70.0.346. It has…5.5
Are you affected by CVE-2023-1671?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST