Actively exploited · Published Dec 5, 2023 · Assigned by sonicwall
CVE-2023-44221
High 7.2 Exploited
In plain English
A high-severity OS command injection in SMA100 from SonicWall. Attackers are actively exploiting it in the wild (listed by CISA on May 1, 2025). The chance it is exploited in the next 30 days is estimated at 76.2% (higher than 99.5% of all known vulnerabilities). Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by May 22, 2025.
Official description
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H