Sophos Web Appliance version 4.3.10.4 suffers from a pre-authentication command injection vulnerability.