Is CVE-2023-1671 (Sophos Web Appliance Command Injection) being exploited in the wild?

Yes. CISA added CVE-2023-1671 to its Known Exploited Vulnerabilities catalogue on 16 November 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution. Any organisation running the affected product should treat remediation as urgent.

Why This Vulnerability Is Treated as Actively Exploited

CISA’s inclusion of a vulnerability in the Known Exploited Vulnerabilities catalog is the practical signal that exposure is no longer theoretical. For an internet-facing appliance, that changes the response from routine prioritisation to immediate verification, containment, and remediation because exploitation can occur before an internal review cycle catches up.

The core issue here is command injection in a perimeter product, which is especially dangerous because the vulnerable handler can turn a simple request into server-side execution. That makes the appliance a high-value foothold, not just a patching item, and it is why guidance for Edge Device Security Guide is relevant whenever a public-facing management or gateway layer is involved.

What Exposure Looks Like on the Appliance

The first question is whether the product is deployed anywhere in your environment, including forgotten instances, test segments, or externally managed appliances. If the answer is yes, assume the vulnerable surface may already be reachable unless network exposure is tightly constrained and the vendor’s mitigation guidance has been applied everywhere.

Because command injection can execute operating-system commands, the blast radius is broader than a single application flaw. A successful exploit can enable configuration changes, file access, credential theft, or post-exploitation movement from the appliance into adjacent systems, which is why this class of issue often appears in Web Application Attacks Guide material as a high-severity server-side execution path.

How to Respond When Patching Cannot Happen Immediately

If remediation is delayed, treat the device as exposed and reduce attack surface first. That means removing external reachability where possible, restricting management access to known administrative sources, and checking whether any compensating vendor mitigation exists. For edge appliances, delaying action is only defensible when you have a documented containment step and a clear time bound to complete the fix.

Use the situation to verify whether the appliance has shown signs of abuse already, not just whether the vendor has released a fix. Review authentication logs, system logs, unexpected child processes, config changes, outbound connections, and new accounts or services. CISA’s KEV listing should be paired with the vendor advisory so your team can confirm exact affected versions and the required remediation path without relying on summary articles alone.

Risk and Threat Considerations

Internet-facing appliances are attractive to attackers because they sit at the boundary between trusted and untrusted networks, often with broad internal visibility and weak monitoring. Once command injection is available, the exploit path can shift from a single request to full device compromise, then to credential capture, persistence, or lateral movement.

Failure mechanism: The attacker supplies crafted input to the vulnerable handler, the appliance executes an operating-system command, and the resulting access bypasses the intended application controls.

Impact: The compromise can expose administrative access, internal traffic handling, configuration data, or a foothold into adjacent systems, and it can persist even after the initial web request is closed.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP API Security Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.RA-01 — Asset Vulnerabilities are Identified and Recorded	Active exploitation depends on knowing where the appliance exists and is vulnerable.
	PR.AA-05 — Network Integrity is Protected	Perimeter appliances need restricted exposure and management-path protection.
	DE.CM-01 — Networks and Network Services Are Monitored to Find Potentially Adverse Events	Exploitation of a public-facing appliance should be detectable through network and host telemetry.
Recommendation — Inventory exposed appliances and record the vulnerable instances for rapid remediation. Restrict appliance reachability and management access to trusted sources only. Monitor appliance traffic and host activity for signs of command execution or abuse.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The question is about urgent remediation of an actively exploited software flaw.
	SI-4 — System Monitoring	Checking for earlier compromise requires monitoring logs, processes, and connections.
Recommendation — Apply the vendor fix or mitigation as soon as it is validated. Collect and review host and network telemetry for indicators of exploitation.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed vulnerabilities require prioritised exposure confirmation and remediation.
	CIS-12 — Network Infrastructure Management	Perimeter appliances are network infrastructure that must be tightly managed and isolated.
Recommendation — Prioritise and remediate KEV-listed appliances before routine backlog items. Limit administrative exposure and harden the appliance management plane.
OWASP ASVS	V15 — Secure Software Development Lifecycle and Architecture	Command injection is a classic application-layer execution flaw with architectural consequences.
Recommendation — Review input handling and command execution paths for injection exposure.
OWASP API Security Top 10	API8 — Security Misconfiguration	The issue involves an externally reachable appliance surface where weak exposure controls amplify risk.
Recommendation — Tighten exposed interfaces and remove unnecessary external access to the appliance.

Practitioner Guidance

What to verify: Confirm every deployed instance, not just the production-facing one, then validate whether each system is still reachable from the internet or other untrusted zones. A patch that is only partially deployed or applied after an exploit window is not operationally sufficient.

What to prioritise: Treat external exposure, management-interface reachability, and evidence of command execution as the decision drivers. If you find signs of compromise, rotate any credentials, tokens, or keys that the appliance could access before assuming the host is clean.

Practitioner takeaway: For a KEV-listed appliance flaw with command execution potential, the right question is not “is it patched yet?” but “has it been exposed, abused, or used as a foothold already?”