SonicWall SMA100/SMA 200/SMA 210/SMA 400/SMA 410/SMA 500v 10.2.1.9-57sv SSL-VPN Management Interface os command injection

Summaryinfo

A vulnerability classified as critical has been found in SonicWall SMA100, SMA 200, SMA 210, SMA 400, SMA 410 and SMA 500v 10.2.1.9-57sv. Affected is an unknown function of the component SSL-VPN Management Interface. This manipulation causes os command injection. This vulnerability is registered as CVE-2023-44221. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

Detailsinfo

A vulnerability classified as critical was found in SonicWall SMA100, SMA 200, SMA 210, SMA 400, SMA 410 and SMA 500v 10.2.1.9-57sv (Firewall Software). Affected by this vulnerability is some unknown processing of the component SSL-VPN Management Interface. The manipulation with an unknown input leads to a os command injection vulnerability. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.

The weakness was published 12/06/2023 as SNWLID-2023-0018. It is possible to read the advisory at psirt.global.sonicwall.com. This vulnerability is known as CVE-2023-44221 since 09/26/2023. Technical details are unknown but an exploit is available. The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

It is declared as attacked. The vulnerability scanner Nessus provides a plugin with the ID 235087 (SonicWall Secure Mobile Access < 10.2.1.10-62sv (SNWLID-2023-0018)), which helps to determine the existence of the flaw in a target environment. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 05/01/2025 with a due date of 05/22/2025:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (235087). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• SonicWall

Name

• SMA100
• SMA 200
• SMA 210
• SMA 400
• SMA 410
• SMA 500v

Version

• 10.2.1.9-57sv

License

• commercial

Website

• Vendor: https://www.sonicwall.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion