CVE-2023-5970

HIGH EXPLOITED

SonicWall SMA 200/210/400/410/500v <10.2.1.9-57sv Authenticated MFA Bypass via Username Spoofing

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-5970 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using accent characters, resulting in an MFA bypass.

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0057
EPSS Percentile 68.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2025-10-23
CWE
CWE-287
Status published
Products (5)
sonicwall/sma_200_firmware < 10.2.1.9-57sv
sonicwall/sma_210_firmware < 10.2.1.9-57sv
sonicwall/sma_400_firmware < 10.2.1.9-57sv
sonicwall/sma_410_firmware < 10.2.1.9-57sv
sonicwall/sma_500v_firmware < 10.2.1.9-57sv
Published Dec 05, 2023
Tracked Since Feb 18, 2026