{"id":"CVE-2023-1671","published":"2023-04-04T10:15:07Z","modified":"2026-06-17T05:28:29Z","title":"Sophos Web Appliance Command Injection Vulnerability","vendor":"Sophos","product":"Web Appliance","tier":"core","eol":null,"description":{"text":"A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.","provenance":"source","from":"NVD"},"summary":{"text":"A pre-authentication command injection flaw in the warn-proceed handler of Sophos Web Appliance, affecting versions older than 4.3.10.4, lets attackers run arbitrary code on the appliance. An attacker needs only network access to the appliance, with no credentials and no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:42Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":0.99991,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2023-11-16","dueDate":"2023-12-07","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce;  https://nvd.nist.gov/vuln/detail/CVE-2023-1671","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-11-16","exploitedFirstSeen":"2023-11-16","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-11-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-29&host_type=src&vulnerability=cve-2023-1671","date":"2023-11-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-04&host_type=src&vulnerability=cve-2023-1671","date":"2023-12-04"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-10&host_type=src&vulnerability=cve-2023-1671","date":"2023-12-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-14&host_type=src&vulnerability=cve-2023-1671","date":"2023-12-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-15&host_type=src&vulnerability=cve-2023-1671","date":"2023-12-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-19&host_type=src&vulnerability=cve-2023-1671","date":"2023-12-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-20&host_type=src&vulnerability=cve-2023-1671","date":"2023-12-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-22&host_type=src&vulnerability=cve-2023-1671","date":"2023-12-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2023-1671","date":"2024-01-22"}],"evidenceTotal":688,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"}],"references":[{"url":"http://packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-1671","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated network request to exposed web handler","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"A pre-auth command injection vulnerability in the warn-proceed handler","start":0,"end":70}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Command injection yields arbitrary code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows execution of arbitrary code","start":123,"end":157}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-23899","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-23899","exploited":true,"exploitedSince":"2023-11-16","provenance":"source"},"exploits":[{"id":51396,"url":"https://www.exploit-db.com/exploits/51396","title":"Sophos Web Appliance 4.3.10.4 - Pre-auth command injection","type":"webapps","platform":"php","date":"2023-04-25","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2023-04-25"},"pocGithub":{"count":3,"skipped":0,"earliest":"2023-04-23","earliestUrl":"https://github.com/ohnonoyesyes/CVE-2023-1671","repos":[{"name":"W01fh4cker/CVE-2023-1671-POC","url":"https://github.com/W01fh4cker/CVE-2023-1671-POC","stars":15,"created":"2023-04-24"},{"name":"ohnonoyesyes/CVE-2023-1671","url":"https://github.com/ohnonoyesyes/CVE-2023-1671","stars":3,"created":"2023-04-23"},{"name":"csffs/cve-2023-1671","url":"https://github.com/csffs/cve-2023-1671","stars":0,"created":"2023-05-17"}]},"nuclei":[{"id":"CVE-2023-1671","name":"Sophos Web Appliance - Remote Code Execution","severity":"critical","path":"http/cves/2023/CVE-2023-1671.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1671.yaml"}],"first":{"date":"2023-04-23","source":"PoC-in-GitHub","url":"https://github.com/ohnonoyesyes/CVE-2023-1671"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2023-04-04","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1671","provenance":"source"},{"date":"2023-04-23","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2023-04-25","url":"https://github.com/ohnonoyesyes/CVE-2023-1671","provenance":"source"},{"date":"2023-11-16","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2023-11-16","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-11-16","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-23899","provenance":"source"}],"speed":{"daysToPublicExploit":19,"firstExploitFrom":"PoC-in-GitHub","daysToKev":226},"priority":{"score":69.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1080 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 3 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}