CVE-2023-44221
HIGH KEVSonicWall SMA 200/210/400/410/500v Firmware < 10.2.1.9-57sv - Authenticated OS Command Injection
Title source: llmExploitation Summary
CVE-2023-44221 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 1, 2025.
Description
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
References (2)
Core 2
Core References
US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44221
Vendor Advisory vendor-advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018
Scores
CVSS v3
7.2
EPSS
0.2307
EPSS Percentile
96.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
active
Automatable
no
Technical Impact
total
Details
CISA KEV
2025-05-01
VulnCheck KEV
2025-04-29
ENISA EUVD
EUVD-2023-48580
CWE
CWE-78
Status
published
Products (5)
sonicwall/sma_200_firmware
< 10.2.1.9-57sv
sonicwall/sma_210_firmware
< 10.2.1.9-57sv
sonicwall/sma_400_firmware
< 10.2.1.9-57sv
sonicwall/sma_410_firmware
< 10.2.1.9-57sv
sonicwall/sma_500v_firmware
< 10.2.1.9-57sv
Published
Dec 05, 2023
KEV Added
May 01, 2025
Tracked Since
Feb 18, 2026