CVE-2023-44221: high-severity vulnerability in SonicWall SMA100
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
The SMA100 SSL-VPN management interface fails to properly filter special characters, allowing an admin user to inject malicious commands that execute with low-level system privileges. This could let an attacker gain unauthorized control over the VPN device.
CWE-78 OS Command Injection vulnerability exists in the SMA100 SSL-VPN management interface due to improper neutralization of special elements in user input. An authenticated administrator can inject arbitrary OS commands that execute in the 'nobody' user context, potentially compromising device integrity and confidentiality.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.