# CVE-2016-9553: Sophos Web Appliance command injection in MgrReport.php

Source: https://junglewise.ai/threats/cve-2016-9553-sophos-web-appliance-command-injection-in-mgrreport-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-28. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-9553 · Severity: high · CVSS 7.2 · Published 2017-01-28

The Sophos Web Appliance, a security tool used to manage and filter web traffic, contains a vulnerability in its administrative interface. An attacker with administrative access can execute unauthorized system commands by exploiting the IP address blocking feature. This could lead to a complete takeover of the appliance, potentially allowing the attacker to intercept network traffic or disrupt security operations.

Technologies: [Sophos Web Appliance](https://junglewise.ai/threats/technologies/web-appliance). Vendors: [Sophos](https://junglewise.ai/threats/vendors/sophos).

## Quick answers

**Is CVE-2016-9553 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-9553 being exploited in the wild.

**How severe is CVE-2016-9553?** High severity, with a CVSS score of 7.2, published 28 January 2017.

**Which products and versions are affected?** Sophos Web Appliance 4.2.1.3.

**Is there a fix for CVE-2016-9553?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2016-9553 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2016-9553?** Check whether you run Sophos Web Appliance. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Sophos Web Appliance (version 4.2.1.3) contains two remote command injection vulnerabilities within the web administrative interface. The flaws exist in the 'MgrReport.php' controller, specifically within the logic responsible for blocking and unblocking IP addresses. The application fails to properly sanitize or escape input passed to the 'blockip' and 'unblockip' variables before passing them to the PHP shell_exec() function. Although the code uses a variable named 'escapedips', it does not actually perform the necessary neutralization of shell metacharacters. An authenticated attacker with administrative privileges can exploit this to execute arbitrary system commands with the privileges of the web server. The issue is addressed in version 4.3.1.

## Affected products

- Sophos Web Appliance 4.2.1.3

## Timeline

- 2016-12-12: other: Vulnerability identified by researcher
- 2017-01-28: advisory: NVD publication date
- 2017-02-22: other: Metasploit module published publicly

## References

- [http://pastebin.com/DUYuN0U5](http://pastebin.com/DUYuN0U5)
- [http://swa.sophos.com/rn/swa/concepts/ReleaseNotes_4.3.1.html](http://swa.sophos.com/rn/swa/concepts/ReleaseNotes_4.3.1.html)
- [http://www.securityfocus.com/bid/95853](http://www.securityfocus.com/bid/95853)
- [https://community.sophos.com/products/web-appliance/b/blog/posts/release-of-swa-version-4-3-1](https://community.sophos.com/products/web-appliance/b/blog/posts/release-of-swa-version-4-3-1)

## Related threats

- [Sophos Web Appliance Command Injection Vulnerability](https://junglewise.ai/threats/cve-2023-1671-sophos-web-appliance-command-injection-vulnerability)
- [Sophos Web Appliance command injection in MgrDiagnosticTools.php](https://junglewise.ai/threats/cve-2016-9554-sophos-web-appliance-command-injection-in-mgrdiagnostictools-php)