References https://nvd.nist.gov/vuln/detail/cve-2023-1671 https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-1671 https://www.vulncheck.com/blog/cve-2023-1671-analysis https://www.picussecurity.com/resource/blog/cve-2023-1671-sophos-command-injection-vulnerability-exploited-in-the-wild https://www.helpnetsecurity.com/2023/11/20/cve-2023-1671/ https://github.com/behnamvanda/CVE-2023-1671 https://github.com/W01fh4cker/CVE-2023-1671-POC https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1671.yaml https://www.exploit-db.com/exploits/51396 https://www.tenable.com/cve/CVE-2023-1671/plugins https://www.sentinelone.com/vulnerability-database/cve-2023-1671/ https://security.zone.ci/aliyun/ali_nvd/35185.html https://www.tenablecloud.cn/plugins/nessus/176075 https://www.securityweek.com/cisa-warns-of-attacks-exploiting-sophos-web-appliance-vulnerability/ https://success.trendmicro.com/en-US/solution/KA-0015698 https://cert.gov.to/wp-content/uploads/2024/02/Security-Bulletin-April-2023.pdf https://qkl.seebug.org/vuldb/ssvid-99679 https://www.ddpoc.com/DVB-2023-4317.html https://avd.aliyun.com/product?prod=web_appliance&page=-16
Related VulnerabilitiesPoCCVE-2022-3236: Sophos Firewall <= 19.0 MR1 - Remote Code ExecutionPoCCVE-2020-25223: Sophos UTM Preauth - Remote Code ExecutionPoCCVE-2022-1040: Sophos Firewall <=18.5 MR3 - Remote Code ExecutionPoCCVE-2022-3980: Sophos Mobile managed on-premises - XML External Entity InjectionPoCCVE-2023-1671: Sophos Web Appliance - Remote Code ExecutionPoCsophos-xg115w-firewall-mr-10-authentication: Sophos XG115w Firewall 17.0.10 MR-10 - Authentication BypassSophos 防火墙 CVE-2022-1040 认证绕过漏洞Sophos Firewall User Portal and Webadmin 代码注入漏洞Sophos Mobile managed on-premises XML外部实体注入(CVE-2022-3980)SOPHOS-Netgenie 默认口令