TI-2015-03496 Aliases CVE-2015-4173 GHSA-34vh-gp42-g4h6

Unquoted Windows search path vulnerability in the autorun value in Dell SonicWall…

LOW 34CWE-428Published 2015-08-26 · Updated 2024-08-06

Key facts

Attack vector: Local
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: Code execution
Confidentiality · integrity · availability: Complete · Complete · Complete
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-428.

Summary

Unquoted Windows search path vulnerability in the autorun value in Dell SonicWall NetExtender before 7.5.227 and 8.0.x before 8.0.238, as used in the SRA firmware before 7.5.1.2-40sv and 8.x before 8.0.0.3-23sv, allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% folder.

Why it matters now

EPSS 0.02066 81st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sonicwall:netextender::::::windows::*	before 7.5.227; 8.0 to before 8.0.238	Vulnerable	SonicWall

cpe:2.3:a:sonicwall:netextender:*:*:*:*:*:windows:*:* Versions before 7.5.227; 8.0 to before 8.0.238 Vulnerable ·SonicWall

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2015-4173
2026-10-03 Alias added: GHSA-34vh-gp42-g4h6

References

Advisory 1

http://packetstormsecurity.com/files/133302/Dell-SonicWall-NetExtender-7.5.215-Privilege-Escalation.html

Other 1

https://support.software.dell.com/product-notification/157537

TI-2024-19198 Code injection in SonicWall NetExtender CVSS 3.1HIGH 8.8
TI-2023-23749 A flaw within the SonicWall NetExtender Pre-Logon feature enables an unauthorized user to… CVSS 3.1HIGH 8.8
TI-2023-23748 Improper privilege management in SonicWall NetExtender CVSS 3.1HIGH 7.8
TI-2022-06611 Stack-based buffer overflow in SonicWall NetExtender Windows Client CVSS 3.1HIGH 7.8
TI-2023-23751 Uncontrolled search path in SonicWall NetExtender CVSS 3.1HIGH 7.3
TI-2020-04225 Improper input validation in SonicWall NetExtender CVSS 3.1HIGH 7.8

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences