Detections
Analytics

CVE-2023-44221

high

Description

Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018

https://hackread.com/watchtowr-exploits-target-sonicwall-sma-100-devices/

https://www.helpnetsecurity.com/2025/05/02/sonicwall-cve-2024-38475-cve-2023-44221-exploited/

https://securityaffairs.com/177301/hacking/u-s-cisa-adds-sonicwall-sma100-and-apache-http-server-flaws-to-its-known-exploited-vulnerabilities-catalog.html

https://www.securityweek.com/sonicwall-flags-two-vulnerabilities-as-exploited/

https://www.cisa.gov/news-events/alerts/2025/05/01/cisa-adds-two-known-exploited-vulnerabilities-catalog

https://thehackernews.com/2025/05/sonicwall-confirms-active-exploitation.html

https://www.bleepingcomputer.com/news/security/sonicwall-sma100-vpn-vulnerabilities-now-exploited-in-attacks/

Details

Source: Mitre, NVD

Published: 2023-12-05

Updated: 2025-05-02

Named Vulnerability: SonicBoomKnown Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.2

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.39496

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest