CVE-2022-3696

—

CVSS 3.1

7.2 high

EPSS

1%p64

Published

Dec 1, 2022 (Dec 1, 2022)

Modified

Jun 17, 2026

Description

A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA.

Vendors: sophos
Products: xg firewall firmware
Weakness: CWE-94
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news1 stories

Sophos fixed a critical flaw in its Sophos Firewall version 19.5

Security AffairsDec 7, 07:03 UTC · Dec 7, 2022Exploit / PoC in the wildCVE-2022-3236 CVE-2022-3226 CVE-2022-3713+4 CVEs

60