Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.4

Sophos UTM Frontend lets local admin see email passwords

CVE-2016-7397 · published 10 years ago
Summary

In Sophos Unified Threat Management devices running firmware 9.405-5 or earlier, a local administrator can view the password stored for SMTP accounts used for notifications. This exposes the email credentials and could allow misuse of the mail system. Upgrade the firmware to a newer version or restrict local admin rights to mitigate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
sophos unified_threat_management_software <= 9.405-5
cpe:2.3:a:sophos:unified_threat_management_software:*:*:*:*:*:*:*:*
Original advisory text
The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "value" field of the SMTP user settings in...
The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "value" field of the SMTP user settings in the notifications configuration tab.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published3 Oct 2016
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-7397 · NVD
Track software like this
Free during beta