CVE-2023-44221
HIGH KEVSonicwall Sma 200 Firmware < 10.2.1.9-57sv - OS Command Injection
Title source: ruleDescription
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
Scores
CVSS v3
7.2
EPSS
0.2174
EPSS Percentile
95.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitation Intel
CISA KEV
2025-05-01
VulnCheck KEV
2025-04-29
ENISA EUVD
EUVD-2023-48580
Classification
CWE
CWE-78
Status
published
Affected Products (5)
sonicwall/sma_200_firmware
< 10.2.1.9-57sv
sonicwall/sma_210_firmware
< 10.2.1.9-57sv
sonicwall/sma_400_firmware
< 10.2.1.9-57sv
sonicwall/sma_410_firmware
< 10.2.1.9-57sv
sonicwall/sma_500v_firmware
< 10.2.1.9-57sv
Timeline
Published
Dec 05, 2023
KEV Added
May 01, 2025
Tracked Since
Feb 18, 2026