CVE-2022-1040

An authentication bypass in the Sophos Firewall User Portal and Webadmin lets a remote attacker skip authentication and execute code on the firewall itself. This is worst-case placement: the vulnerable component is the security appliance sitting at the network edge, and the exploit needs no credentials and no user interaction. Bypassing auth on the very device meant to enforce it, then running code on it, hands an attacker the perimeter.

Edge security appliances are among the most aggressively targeted assets on the internet, precisely because their management surfaces are exposed by design and a compromise yields a commanding position — inside the trust boundary, able to see and reroute traffic, with persistence on a device few teams image or rebuild casually. Unauthenticated RCE on a firewall is exactly what both mass scanners and targeted actors race to weaponize after disclosure, and Sophos edge devices have a track record of being exploited in the wild. This is a drop-everything bug for any affected install.

Our angle is exposure verification first, then detection, because the User Portal and Webadmin are internet-facing by nature. We'd immediately identify any Sophos Firewall at v18.5 MR3 or older, confirm whether its management/portal surfaces are reachable from the internet, and restrict that access to trusted sources as an interim control while applying the vendor fix. Given the target, we'd also hunt for signs of prior compromise rather than assume patching alone is sufficient — an edge device is the kind of asset that gets popped before you finish the inventory.