Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-25269: A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in the HMPA component of Sophos Intercept X Advanced and So...

CVE-2021-25269 · published 4 years ago

Summary

A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in the HMPA component of Sophos Intercept X Advanced and Sophos Intercept X Advanced for Server before version 2.0.23, as well as Sophos Exploit Prevention before...

What to do

Update sophos exploit_prevention to version 3.8.3 or later.
Update sophos intercept_x_endpoint to version 2.0.23 or later.
Update sophos intercept_x_for_server to version 2.0.23 or later.

Affected software

Vendor	Product	Affected versions
sophos	exploit_prevention	< 3.8.3 `cpe:2.3:a:sophos:exploit_prevention::::::::`
sophos	intercept_x_endpoint	< 2.0.23 `cpe:2.3:a:sophos:intercept_x_endpoint::::::::`
sophos	intercept_x_for_server	< 2.0.23 `cpe:2.3:a:sophos:intercept_x_for_server::::::::`

Original advisory text

References

https://www.sophos.com/en-us/security-advisories/sophos-sa-20211126-ixa-hmpa-loc... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.4 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-428Unquoted Search Path or Element

Timeline

Published26 Nov 2021

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2021-25269 · NVD

Track software like this

Free during beta