High · 7.2 CVE-2022-3226 EUVD-2022-42637GHSA-3f66-9wgv-7rw2

An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older tha…

Published Dec 1, 2022 · Updated Apr 24, 2025 · Assigned by Sophos

Vendor: Sophos Product: Sophos Firewall Category: Network devices

Description

An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA.

Affected products

Vendor	Product	Affected	Fixed
Sophos	Sophos Firewall	unspecified – < 19.5 GA, unspecified – < 19.0 MR2, unspecified – < 18.5 MR5	19.5 GA

Advisories 1

WID-SEC-2022-2217 Sophos Firewall: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 7, 2022

References

https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0