Vulnerability · Published Oct 27, 2023 · Assigned by sonicwall
CVE-2023-44220
High 7.3
In plain English
A high-severity uncontrolled search path in NetExtender from SonicWall. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS NVD)7.3High
Exploit odds (30 days)0.3%top 74.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SonicWall NetExtender Windows (32-bit and 64-bit) client 10.2.336 and earlier versions have a DLL Search Order Hijacking vulnerability in the start-up DLL component. Successful exploitation via a local attacker could result in command execution in the target system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SonicWall | NetExtender | 10.2.336 and earlier versions |
Weakness: CWE-427
References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0017 vendor-advisory