{"id":178,"created_when":"2023-12-04T15:17:50Z","created_by":"arun","updated_when":"2023-12-04T15:17:50Z","updated_by":"arun","advisory_id":"SNWLID-2023-0018","title":"SonicWall SSL-VPN SMA100 Version 10.x Is Affected By Multiple Vulnerabilities","published_when":"2023-12-04T15:17:50Z","last_updated_when":"2025-04-29T12:51:15Z","impact":"high","cvss":"7.2","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-78, CWE-287","cve":"CVE-2023-44221, CVE-2023-5970","cpe":"","summary":"

\r\n\r\n

1) CVE-2023-44221 - Post Authentication OS Command Injection Vulnerability

Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.\r\n

CVSS Score: 7.2
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
\r\nCWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\r\n\r\n

IMPACT:\r\n\r\nAs outlined in SNWLID-2023-0018, successfully leveraging CVE-2023-44221 against impacted SMA 100 devices can result in the post-authenticated remote attacker with administrative privilege being able to inject arbitrary commands which can potentially lead to OS command execution on the appliance.


\r\n\r\n

2) CVE-2023-5970 - Post Authentication External User MFA Bypass Vulnerability

Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user, resulting in an MFA bypass.

CVSS Score: 6.3
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
\r\nCWE-287: Improper Authentication\r\n\r\n

IMPACT:\r\n\r\nAs outlined in SNWLID-2023-0018, successfully leveraging CVE-2023-5970 against impacted SMA 100 devices can result in the post-authenticated remote attacker being able to bypass the SMA100 MFA feature which can potentially lead to access to the globally defined SSL-VPN portal bookmarks and resources in the appliance.


SonicWall strongly advises SMA 100 series product users, which include SMA 200, 210, 400, 410, and 500v products to upgrade to the mentioned fixed release version.

","is_workaround_available":false,"workaround":"None.","detail":"

Note: During further analysis, SonicWall and trusted security partners identified that 'CVE-2023-44221 - Post Authentication OS Command Injection' vulnerability is potentially being exploited in the wild.

SMA100 devices updated with the fixed firmware version 10.2.1.10-62sv or latest release version are not vulnerable to CVE-2023-44221 exploitation. SonicWall PSIRT recommends that customers review their SMA devices to ensure no unauthorized logins.

","affected_products":"\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n
\r\n

Impacted\r\n Product(s)

\r\n 		\r\n

Impacted\r\n Versions

\r\n
\r\n

SMA\r\n 100 Series
\r\n (SMA\r\n 200, 210, 400, 410, 500v)

\r\n 		\r\n

10.2.1.9-57sv and earlier versions.

\r\n

","fixed_software":"\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n
\r\n

Fixed Product(s)

\r\n 		\r\n

Fixed Versions

\r\n
\r\n

SMA\r\n 100 Series
\r\n (SMA\r\n 200, 210, 400, 410, 500v)

\r\n 		\r\n

10.2.1.10-62sv and higher versions.

\r\n

","credits":"\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n
\r\n

Vulnerabilities

\r\n 		\r\n

Reporter(s)

\r\n
\r\n

CVE-2023-44221

\r\n 		\r\n

Wenjie Zhong (H4lo) Webin lab of DBappSecurity Co., Ltd.

\r\n
\r\n

CVE-2023-5970

\r\n 		\r\n

Michel Toussaint

\r\n


","revision_history":"\r\n\r\n\r\n\r\n\r\n","references":"https://www.sonicwall.com/support/notices/231127094418307","vuln_status":"Applicable","status":"published","is_published":true,"patterns":[{"id":4,"pattern":"^(?:[0-9]\\.\\d+\\.\\d+\\.\\d+-\\d+sv|10\\.[0-1]\\.\\d+\\.\\d+-\\d+sv|10\\.2\\.0\\.\\d+-\\d+sv|10\\.2\\.1\\.[0-8]-\\d+sv|10\\.2\\.1\\.9-(?:[0-9]|[1-4]\\d|5[0-6])sv|10\\.2\\.1\\.9-57sv)$","name":"Secure Mobile Access (SMA) 100 Series"}],"vulnerable_products":[{"id":4,"name":"Secure Mobile Access (SMA) 100 Series"}]}