CVE-2023-44221: SonicWall SMA100 Appliances OS Command Injection Vulnerability
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
Other sources
SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.
— CISA
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2023-44221?
CVE-2023-44221 has been classified with a medium to high severity, indicating a significant risk for systems affected.
How do I fix CVE-2023-44221?
To mitigate CVE-2023-44221, users should upgrade to the latest firmware versions of the SonicWall SMA series that address this vulnerability.
Who is affected by CVE-2023-44221?
CVE-2023-44221 impacts SonicWall SMA models 200, 210, 400, 410, and 500v running firmware versions up to and including 10.2.1.9-57sv.
What type of vulnerability is CVE-2023-44221?
CVE-2023-44221 is categorized as an OS command injection vulnerability due to improper neutralization in the SSL-VPN management interface.
Can CVE-2023-44221 be exploited remotely?
Yes, CVE-2023-44221 can be exploited by a remote authenticated attacker with administrative privileges.