CVE-2023-1671
This CVE is being exploited. Apply the vendor fix, or take the service off the internet until you can, then check your logs for attempts.
What it is
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.
Live exploitation on the huntback network (30 days)
Detection
Evidence
Confirmed exploited. Our decoys saw 1 exploitation attempt in the last 14 days; CISA added it to KEV 1092 days ago.
Last attempt. 3 attempts on our decoys, 1 in the last 14 days
First exploitation attempt on our decoys
Added to CISA Known Exploited Vulnerabilities
Published
Exploit code published (ExploitDB)
Nuclei detection template available
Observed: our own decoys saw it. Reported: CISA, the vendor or another named source says so. Weaponised: public exploit code or a scanner template exists. Methodology
Questions
Is CVE-2023-1671 being exploited in the wild?
Yes. The huntback decoy network captured 3 exploitation attempts from 1 distinct source IPs; the most recent was on 2026-11-04. It is also in the CISA KEV catalogue.
Can CVE-2023-1671 be detected on the network?
Yes. huntback carries a network signature for CVE-2023-1671, so attempts against a decoy are tagged in real time.
How huntback helps
Deploy a decoy that emulates Web Appliance and you will see every attempt at this CVE the moment it lands, with the full payload, the attacker's infrastructure, and any stage-2 loader. Then huntback can scan the attacker back.
Related
NVD record → Browse all CVEs → Live malware and C2 finds → Novel-attack discovery → Deploy a decoy →API
This record, with its evidence timeline, as JSON:
curl -H "X-API-Key: $HUNTBACK_KEY" https://app.huntback.io/api/v1/evidence/CVE-2023-1671