Overview

A critical shell injection vulnerability in Sophos Cyberoam Firewall appliances running CyberoamOS (CROS) version 10.6.6 MR-5 and earlier was recently discovered and responsibly disclosed to Sophos by an external security researcher.

The vulnerability can be potentially exploited by sending a malicious request to either the Web Admin or SSL VPN consoles, which would enable an unauthenticated remote attacker to execute arbitrary commands.

Applies to the following Sophos products and versions
Cyberoam Firewalls running CROS 10.6.6 MR-5 and earlier

Remediation

• For customers running CROS version 10.6.4 and later, who use the default automatic updates setting, the security update has been automatically installed since September 30, 2019 and there is no action required.
• For customers who keep automatic updates disabled or otherwise cannot receive them, the patch is available via Sophos Support.
• The vulnerability will be resolved in CROS version 10.6.6 MR-6.

Sign up to the Sophos Support SMS Notification Service to get the latest product release information and critical issues.

Feedback and contact

If you’ve spotted an error or would like to provide feedback on this article, please use the section below to rate and comment on the article.
This is invaluable to us to ensure that we continually strive to give our customers the best information possible.Article appears in the following topics

• Advisories
• Sophos UTM 9
• CyberoamOS