CVE-2023-44221
SonicWall SMA100 Appliances OS Command Injection Vulnerability
Description
CVE-2023-44221 is a high-severity OS command injection vulnerability in the SonicWall SMA100 series SSL-VPN management interface. The flaw allows a remote authenticated attacker with administrative privileges to inject and execute arbitrary operating system commands as the 'nobody' user on the underlying appliance. Rated 7.2 on the CVSS v3.1 scale (HIGH severity), successful exploitation grants command-level access to the SMA appliance, potentially compromising confidentiality, integrity, and availability of the device and the networks it protects. CISA has added CVE-2023-44221 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 22, 2025, and the EPSS score of 22.34% at the 95.70th percentile reflects a very high likelihood of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sonicwall | sma 200 firmware | <= 10.2.1.9-57sv |
| sonicwall | sma 210 firmware | <= 10.2.1.9-57sv |
| sonicwall | sma 400 firmware | <= 10.2.1.9-57sv |
| sonicwall | sma 410 firmware | <= 10.2.1.9-57sv |
| sonicwall | sma 500v firmware | <= 10.2.1.9-57sv |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44221(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2023-44221 is classified under CWE-78, commonly known as OS command injection. In the SonicWall SMA100 SSL-VPN management interface, certain input fields used by administrative functions are not properly sanitized before being incorporated into operating system commands. An attacker with administrative credentials can inject shell metacharacters to execute arbitrary commands on the underlying operating system with the privileges of the 'nobody' user.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command
Impact Analysis
CVE-2023-44221 carries a CVSS v3.1 base score of 7.2 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating a network-accessible attack (AV:N) with low complexity (AC:L) but requiring high privileges (PR:H). While the requirement for administrative credentials limits the pool of potential attackers, compromised admin accounts, insider threats, or credential stuffing attacks against VPN management interfaces make this a realistic attack scenario. The impact is severe across all three CIA dimensions: Confidentiality (High) means the attacker can read sensitive configuration data, VPN session information, user credentials, and network topology details stored on the appliance. Integrity (High) allows modification of device configurations, injection of persistent backdoors, and manipulation of VPN policies. Availability (High) enables disruption of VPN services affecting all connected users. The EPSS score of 22.3% at the 95.7th percentile indicates a very high probability of exploitation, confirming that threat actors are actively targeting this vulnerability despite the elevated privilege requirement.
Exploit Maturity
CVE-2023-44221 has been confirmed as actively exploited in the wild, evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of May 22, 2025. The EPSS score of 22.3% at the 95.7th percentile indicates a very high probability of exploitation, placing it well above the threshold for widespread exploitation. The SonicWall PSIRT advisory (SNWLID-2023-0018) provides official vendor disclosure. SonicWall SMA appliances are high-value targets for threat actors because they serve as network perimeter devices that, when compromised, provide direct access to internal corporate networks. The combination of active exploitation and the strategic position of SMA appliances in enterprise network architectures makes this vulnerability a critical priority for remediation.
Remediation
-
Apply the SonicWall firmware update immediately. Upgrade all SMA 200, 210, 400, 410, and 500v appliances to firmware versions newer than 10.2.1.9-57sv. Consult the SonicWall PSIRT advisory SNWLID-2023-0018 for specific upgrade guidance.
-
Restrict management interface access. Limit access to the SMA100 SSL-VPN management interface to a dedicated management network or specific trusted IP addresses. Never expose the management interface directly to the internet.
-
Audit administrative accounts. Review all administrative accounts on the SMA appliance, remove unnecessary admin accounts, enforce strong passwords, and enable multi-factor authentication (MFA) for all administrative access.
-
Conduct forensic analysis. Review appliance logs for signs of command injection, including unusual process execution, unauthorized configuration changes, or unexpected network connections. Check for evidence of credential harvesting or lateral movement.
-
Implement network segmentation. Ensure the SMA appliance is deployed in a DMZ with strict firewall rules that limit outbound connections to only necessary destinations, reducing the impact of any command execution achieved through this vulnerability.
Technical Details
CVE-2023-44221 is an OS command injection vulnerability in the SonicWall SMA100 SSL-VPN management interface. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H reflects that while the attack is network-accessible with low complexity, it requires high-level (administrative) privileges to exploit. The scope remains unchanged, meaning the impact is confined to the vulnerable component itself.
The vulnerability exists in the management interface's handling of administrative input. When an authenticated administrator performs certain operations, user-supplied parameters are passed to the operating system shell without adequate sanitization of special characters such as semicolons, pipes, backticks, or command substitution sequences. This allows an attacker to append or inject additional commands that execute with the privileges of the 'nobody' user. Although the 'nobody' user has limited privileges compared to root, it is typically sufficient to read sensitive configuration files, access VPN session data, install persistent access mechanisms, and potentially escalate privileges through additional local exploits on the appliance's embedded operating system.
Frequently Asked Questions
Is CVE-2023-44221 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2023-44221 by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 22.34% at the 95.70th percentile indicates a very high probability of ongoing exploitation.
What products are affected by CVE-2023-44221?
SonicWall SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v appliances running firmware version 10.2.1.9-57sv and earlier are affected. All SMA100 series appliances with the SSL-VPN management interface exposed are at risk.
How do I fix CVE-2023-44221?
Upgrade the SMA100 firmware to a version newer than 10.2.1.9-57sv as specified in the SonicWall PSIRT advisory. Additionally, restrict management interface access to trusted networks and enforce multi-factor authentication for all administrative accounts.
How severe is CVE-2023-44221?
CVE-2023-44221 has a CVSS v3.1 score of 7.2 (HIGH). Although it requires administrative privileges to exploit, the full compromise of confidentiality, integrity, and availability makes it a serious threat, especially given that SMA appliances are critical network perimeter devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.