OS command injection in SonicWall SMA100
Priority CRITICAL 91Exploited in the wildCWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-78.
Summary
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
Why it matters now
Exploitation Active In CISA KEV since 2025-05-01CISA due date 2025-05-22
EPSS 0.7625 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SonicWall | SMA100 | 10.2.1.9-57sv and earlier versions | — | No fix listed | CNA |
- SMA100 VendorSonicWall Affected 10.2.1.9-57sv and earlier versions Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:* | up to 10.2.1.9-57sv | Vulnerable | SonicWall |
| cpe:2.3:h:sonicwall:sma_200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SonicWall |
| cpe:2.3:o:sonicwall:sma_210_firmware:*:*:*:*:*:*:*:* | up to 10.2.1.9-57sv | Vulnerable | SonicWall |
| cpe:2.3:h:sonicwall:sma_210:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SonicWall |
| cpe:2.3:o:sonicwall:sma_400_firmware:*:*:*:*:*:*:*:* | up to 10.2.1.9-57sv | Vulnerable | SonicWall |
| cpe:2.3:h:sonicwall:sma_400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SonicWall |
| cpe:2.3:o:sonicwall:sma_410_firmware:*:*:*:*:*:*:*:* | up to 10.2.1.9-57sv | Vulnerable | SonicWall |
| cpe:2.3:h:sonicwall:sma_410:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SonicWall |
| cpe:2.3:o:sonicwall:sma_500v_firmware:*:*:*:*:*:*:*:* | up to 10.2.1.9-57sv | Vulnerable | SonicWall |
| cpe:2.3:h:sonicwall:sma_500v:-:*:*:*:*:*:*:* | not specified by NVD | Running on | SonicWall |
- cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:* Versions up to 10.2.1.9-57sv Vulnerable ·SonicWall
- cpe:2.3:h:sonicwall:sma_200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SonicWall
- cpe:2.3:o:sonicwall:sma_210_firmware:*:*:*:*:*:*:*:* Versions up to 10.2.1.9-57sv Vulnerable ·SonicWall
- cpe:2.3:h:sonicwall:sma_210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SonicWall
- cpe:2.3:o:sonicwall:sma_400_firmware:*:*:*:*:*:*:*:* Versions up to 10.2.1.9-57sv Vulnerable ·SonicWall
- cpe:2.3:h:sonicwall:sma_400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SonicWall
- cpe:2.3:o:sonicwall:sma_410_firmware:*:*:*:*:*:*:*:* Versions up to 10.2.1.9-57sv Vulnerable ·SonicWall
- cpe:2.3:h:sonicwall:sma_410:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SonicWall
- cpe:2.3:o:sonicwall:sma_500v_firmware:*:*:*:*:*:*:*:* Versions up to 10.2.1.9-57sv Vulnerable ·SonicWall
- cpe:2.3:h:sonicwall:sma_500v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SonicWall
Remediation
No fixed version listed by the sources yet.
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
SonicWall SMA100 — psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018
2 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM
Other records, highest priority first
- TI-2023-05501 Improper authentication in SonicWall SMA100Priority MEDIUM 40
Timeline
- 2025-05-01 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2023-44221
- 2026-10-03 Alias added: GHSA-q6mf-v98h-w783
References
More SonicWall Sma 200 Firmware vulnerabilities
- TI-2021-03356 Stack-based buffer overflow in SonicWall SMA100 KEVCVSS 3.1CRITICAL 9.8
- TI-2021-03337 SQL injection in SonicWall SMA100 KEVCVSS 3.1CRITICAL 9.8
- TI-2024-25716 Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. KEVCVSS 3.1CRITICAL 9.1
- TI-2021-03354 OS command injection in SonicWall SMA100 KEVCVSS 3.1MEDIUM 6.5
- TI-2021-03357 OS command injection in SonicWall SMA100 CVSS 3.1HIGH 8.8
- TI-2021-03353 Improper access control in SonicWall SMA100 CVSS 3.1CRITICAL 9.1
Sources
- CVE-2023-44221 · CVE Program
- CVE-2023-44221 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-q6mf-v98h-w783 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences