Security readout for executives and security teams
Plain-English summary
CVE-2022-1807 is a high-severity issue in Sophos Firewall Webadmin. An attacker who already has administrator access could use SQL injection flaws to escalate to super-admin, gaining broader control over the firewall.
Executive priority
Prioritize remediation for internet-facing or broadly reachable management interfaces and environments with shared admin access. This is not described as unauthenticated or actively exploited in the provided sources, but firewall super-admin compromise can carry high operational impact.
Technical view
The CVE describes multiple CWE-89 SQL injection vulnerabilities in Sophos Firewall Webadmin. The reported impact is privilege escalation from admin to super-admin in versions older than 18.5 MR4 and 19.0 MR1. CVSS 3.1 is 7.2 with network attack vector and high privileges required.
Likely exposure
Exposure is most relevant for organizations running Sophos Firewall versions older than 18.5 MR4 or 19.0 MR1, especially where Webadmin is reachable and multiple administrator accounts exist. The flaw requires an authenticated admin-level user, limiting broad unauthenticated exposure.
Exploitation context
The provided bundle does not show CISA KEV listing or cited evidence of active exploitation. Risk is still meaningful because successful exploitation could turn an existing firewall administrator account into super-admin control.
Researcher notes
Evidence is limited to the CVE bundle and Sophos advisory references. Do not assume exploit availability or affected build details beyond the stated thresholds. Focus validation on version status, Webadmin exposure, and administrator privilege hygiene.
Mitigation direction
- Upgrade Sophos Firewall to 18.5 MR4, 19.0 MR1, or a later vendor-supported release.
- Review Sophos advisory guidance for version-specific upgrade instructions and caveats.
- Restrict Webadmin access to trusted management networks where operationally possible.
- Review firewall administrator accounts and remove unnecessary privileged access.
Validation and detection
- Inventory Sophos Firewall versions and identify systems below 18.5 MR4 or 19.0 MR1.
- Confirm whether Webadmin is exposed beyond trusted management networks.
- Verify successful upgrade through the firewall version and maintenance release status.
- Review administrative account changes for unexpected super-admin assignments.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-1807 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H1.25.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.sophos.com/en-us/security-advisories/sophos-sa-20220907-sfos-18-5-4CVE reference · x_refsource_CONFIRM
- https://www.sophos.com/en-us/security-advisories/sophos-sa-20220907-sfos-19-0-1CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.