Command Injection Vulnerability in Sophos Web Appliance (CVE‑2023‑1671) Enables Remote Code Execution
What It Is — Sophos Web Appliance contains a command‑injection flaw in the warn‑proceed handler that can be abused to execute arbitrary commands on the underlying system.
Exploitability — The vulnerability is remotely exploitable without authentication; proof‑of‑concept code is publicly available. CVSS v3.1 base score is 9.8 (Critical).
Affected Products — Sophos Web Appliance (all versions prior to the vendor‑released patch on 2023‑09‑12).
Why It Matters for Trust & Control Assurance
- Continuous control monitoring must capture patch‑management evidence to demonstrate due‑diligence in a defensible audit trail.
- An unpatched command‑injection bypasses the “secure configuration” control, exposing the organization to unauthorized code execution and data loss.
- Enterprise buyers increasingly require proof that security appliances are kept up‑to‑date, linking remediation to a single control objective that satisfies multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
Recommended Actions
- Apply Sophos’s security update for CVE‑2023‑1671 immediately.
- Verify the appliance version post‑patch and record the change in your configuration‑management system.
- Enable and review detailed command‑execution logs to detect any attempted exploitation.
- Map the remediation to the “Secure Configuration” control in your framework of record and capture evidence in the Trust Center.
Source: CISA KEV – CVE‑2023‑1671