CVE-2023-44221: SonicWall SMA100 Appliances OS Command Injection Vulnerability
SonicWall · SMA100 Appliances · NVD published 2023-12-06 · posted 2025-05-01 · last modified 2026-06-17
What it is
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
| Weakness | CWE-78 |
|---|---|
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (source: [email protected]) |
| CISA due date | 2025-05-22 (for US federal agencies under BOD; a good deadline for everyone) |
| ATT&CK tactics | Execution → Persistence → Privilege Escalation |
Exploitation evidence
First exploit evidence seen: 2025-05-01 (earliest date across the sources below).
Exploited in the wild
- CISA KEV: listed since 2025-05-01. Source
Sources: CISA KEV.
Defend the Chain
The attack chain for CVE-2023-44221 laid across the MITRE ATT&CK Enterprise tactics. Solid cards come from the MITRE CTID KEV mappings; dashed cards are inferred by CVERadar from the CWE or description. Correct defences are real ATT&CK mitigations for that technique.
Pick a red technique card on the board, then choose the defence that stops it.
Defend against T1059.004 Unix Shell CTID: primary impact
This post-authentication command injection vulnerability is chained with CVE-2024-38475 to allow command execution as the nobody user, affecting versions below 10.2.1.10-62sv.
How to fix it
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (source: CISA KEV)
Fixed versions
- sonicwall sma 200 firmware: versions up to and including 10.2.1.9-57sv are affected; check the vendor advisory for the fixed release.
- sonicwall sma 210 firmware: versions up to and including 10.2.1.9-57sv are affected; check the vendor advisory for the fixed release.
- sonicwall sma 400 firmware: versions up to and including 10.2.1.9-57sv are affected; check the vendor advisory for the fixed release.
- sonicwall sma 410 firmware: versions up to and including 10.2.1.9-57sv are affected; check the vendor advisory for the fixed release.
- sonicwall sma 500v firmware: versions up to and including 10.2.1.9-57sv are affected; check the vendor advisory for the fixed release.
Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.
Vendor advisories and patches
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018 (CISA KEV notes)
MITRE ATT&CK mitigations for this chain
- M1038 Execution Prevention (for T1059.004, T1068, T1548) : Use application control where appropriate. On ESXi hosts, the `execInstalledOnly` feature prevents binaries from being run unless they have been packaged and signed as part of a vSphere installation bundle (VIB).
- M1018 User Account Management (for T1543, T1548) : Limit privileges of user accounts and groups so that only authorized administrators can interact with system-level process changes and service configurations.
- M1040 Behavior Prevention on Endpoint (for T1543) : On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent an application from writing a signed vulnerable driver to the system. On Windows 10 and 11, enable Microsoft Vulnerable Driver Blocklist to assist in hardening against third party-developed drivers.
- M1033 Limit Software Installation (for T1543) : Restrict software installation to trusted repositories only and be cautious of orphaned software packages.
- M1026 Privileged Account Management (for T1543, T1548) : Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.
- M1028 Operating System Configuration (for T1543, T1548) : Ensure that Driver Signature Enforcement is enabled to restrict unsigned drivers from being installed.
- M1047 Audit (for T1543, T1548) : Use auditing tools capable of detecting privilege and service abuse opportunities on systems within an enterprise and correct them.
- M1054 Software Configuration (for T1543) : Where possible, consider enforcing the use of container services in rootless mode to limit the possibility of privilege escalation or malicious effects on the host running the container.
- M1022 Restrict File and Directory Permissions (for T1543, T1548) : Restrict read/write access to system-level process files to only select privileged users who have a legitimate need to manage system services.
- M1045 Code Signing (for T1543) : Enforce registration and execution of only legitimately signed service drivers where possible.
Detection Generic guidance
- Execution: Watch for the service process spawning shells or script interpreters (cmd.exe, powershell, sh, bash, python) via EDR process-tree rules.
- Persistence: Look for new files in web roots, new scheduled tasks/services, and new accounts created after the exposure window.
- Privilege Escalation: Alert on processes gaining SYSTEM/root unexpectedly, and on exploitation crashes of privileged services.
Response checklist Generic guidance
- Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
- Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
- Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
- Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.