CVE-2022-3713 : Security Advisory and Response

A critical code injection vulnerability has been identified in the Wifi controller of Sophos Firewall releases older than version 19.5 GA, allowing adjacent attackers to execute malicious code.

Understanding CVE-2022-3713

This section delves into the details of CVE-2022-3713, its impact, technical aspects, and mitigation strategies.

What is CVE-2022-3713?

CVE-2022-3713 is a code injection vulnerability that enables adjacent attackers to execute arbitrary code in the Wifi controller of vulnerable Sophos Firewall releases.

The Impact of CVE-2022-3713

This vulnerability poses a high risk as it allows attackers in close proximity to the target network to execute malicious code, potentially leading to complete compromise of the affected systems.

Technical Details of CVE-2022-3713

Let's explore the technical aspects of CVE-2022-3713, including the vulnerability description, affected systems, and exploitation mechanism.

Vulnerability Description

The code injection flaw in Sophos Firewall versions less than 19.5 GA permits attackers to execute arbitrary code within the Wifi controller, posing a severe security risk.

Affected Systems and Versions

Sophos Firewall versions less than 19.5 GA, 19.0 MR2, and 18.5 MR5 are confirmed to be impacted by this vulnerability, requiring immediate attention and remediation.

Exploitation Mechanism

To exploit CVE-2022-3713, attackers need to be in close proximity to the target network and send specially crafted requests to the vulnerable Wifi controller, enabling unauthorized code execution.

Mitigation and Prevention

Here are the essential steps to mitigate and prevent exploitation of CVE-2022-3713 to safeguard Sophos Firewall deployments.

Immediate Steps to Take

Update Sophos Firewall to version 19.5 GA or newer to eliminate the code injection vulnerability.
Implement network segmentation and access controls to limit exposure to adjacent network threats.

Long-Term Security Practices

Regularly update and patch Sophos Firewall to address security vulnerabilities promptly.
Conduct security assessments and penetration testing to identify and remediate potential weaknesses in the network infrastructure.

Patching and Updates

Stay informed about security advisories and updates from Sophos to apply patches and security fixes as soon as they are available.