CVE-2016-7397

Severity: medium (CVSS 4.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-10-03 · updated 2026-06-17
Weakness: CWE-200

Description

The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "value" field of the SMTP user settings in the notifications configuration tab.

Affected products

Sophos Unified Threat Management Software: through 9.405-5

References

http://www.securityfocus.com/archive/1/539518/100/0/threaded
http://www.securityfocus.com/bid/93266
http://www.securitytracker.com/id/1036931
http://www.securityfocus.com/archive/1/539518/100/0/threaded
http://www.securityfocus.com/bid/93266
http://www.securitytracker.com/id/1036931

Get alerted when CVE-2016-7397 or the next vulnerability affects your stack