Detections
Analytics
CVE-2023-44221
high
Description
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
References
https://www.cybereason.com/blog/ttp-briefing-q3-2025
https://www.darkreading.com/threat-intelligence/akira-sonicwall-firewalls-zero-day
https://cyberscoop.com/sonicwall-exploited-vulnerabilities-surge/
https://thehackernews.com/2025/05/sonicwall-patches-3-flaws-in-sma-100.html
https://www.hipaajournal.com/sonicwall-sma-vulnerabilities-actively-exploited-in-attacks/
https://hackread.com/watchtowr-exploits-target-sonicwall-sma-100-devices/
https://www.helpnetsecurity.com/2025/05/02/sonicwall-cve-2024-38475-cve-2023-44221-exploited/
https://www.securityweek.com/sonicwall-flags-two-vulnerabilities-as-exploited/
https://thehackernews.com/2025/05/sonicwall-confirms-active-exploitation.html
Details
Published: 2023-12-05
Updated: 2025-10-31
Known Exploited Vulnerability (KEV)
Risk Information
CVSS v2
Base Score: 8.3
Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C
Severity: High
CVSS v3
Base Score: 7.2
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: High
EPSS
EPSS: 0.16634
Vulnerability Watch
Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.
Vulnerability of Interest