CVE-2022-4934

CVE-2022-4934 is a post-authentication command injection vulnerability found in the exception wizard of Sophos Web Appliance versions older than 4.3.10.4, allowing authenticated administrators to execute arbitrary code. With a CVSS score of 7.2 (HIGH), this vulnerability is easily exploitable over the network with high impact on confidentiality, integrity, and availability, requiring high privileges for successful exploitation. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Despite limited community discussion and media coverage, Sophos has released patches to address this critical flaw.