CVE-2022-3236criticalKEV

Sophos Firewall <= 19.0 MR1 - Remote Code Execution

Events 90d

Distinct IPs

Severity

critical

CISA KEV

Actively exploited

Detection signature

An event counts toward CVE-2022-3236 when its URL path contains any of these (case-insensitive). This is what our matching is based on.

Analysing probe history around the publication date…

peak: 32 events/day

eventsdistinct IPs

The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.

/userportal/Controller?mode=8700&operation=1&datagrid=179&json={"%f0%9f%a6%9e":"test"}
/userportal/Controller
/webconsole/Controller
/userportal/Controller?mode=8700&operation=1&datagrid=179&json={"🦞":"test"}