CVE-2023-44221

HIGH KEV

SonicWall SMA 200/210/400/410/500v Firmware < 10.2.1.9-57sv - Authenticated OS Command Injection

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-44221 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 1, 2025.

Description

Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.

Scores

CVSS v3 7.2
EPSS 0.2307
EPSS Percentile 96.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2025-05-01
VulnCheck KEV 2025-04-29
ENISA EUVD EUVD-2023-48580
CWE
CWE-78
Status published
Products (5)
sonicwall/sma_200_firmware < 10.2.1.9-57sv
sonicwall/sma_210_firmware < 10.2.1.9-57sv
sonicwall/sma_400_firmware < 10.2.1.9-57sv
sonicwall/sma_410_firmware < 10.2.1.9-57sv
sonicwall/sma_500v_firmware < 10.2.1.9-57sv
Published Dec 05, 2023
KEV Added May 01, 2025
Tracked Since Feb 18, 2026