CVE-2023-34127

HIGH

SonicWall GMS <9.3.2-SP1, Analytics <2.5.0.4-R7 - Command Injection

Title source: llm
STIX 2.1

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analytics enables an authenticated attacker to execute arbitrary code with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.

References (3)

Core 3

Scores

CVSS v3 8.8
EPSS 0.9058
EPSS Percentile 99.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (3)
sonicwall/analytics < 2.5.0.4-r7
sonicwall/global_management_system 9.3.2 (2 CPE variants)
sonicwall/global_management_system < 9.3.2
Published Jul 13, 2023
Tracked Since Feb 18, 2026