{"id":"CVE-2023-44221","kind":"vulnerability","aliases":["CVE-2023-44221"],"related":[],"title":"Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated…","description":"SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"SonicWall SMA100 SSL-VPN appliances have an OS command injection flaw in the management interface. An attacker with administrator credentials can run arbitrary commands on the appliance as the 'nobody' user.","severity":"high","cvss":7.2,"epss":null,"exploited":true,"exploited_at":"2025-05-01T00:00:00+00:00","products":[{"name":"SonicWall SMA100 Appliances","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"sonicwall sma 200 firmware","fixed":[],"affected":"<= 10.2.1.9-57sv","ecosystem":"vendor"},{"name":"sonicwall sma 210 firmware","fixed":[],"affected":"<= 10.2.1.9-57sv","ecosystem":"vendor"},{"name":"sonicwall sma 400 firmware","fixed":[],"affected":"<= 10.2.1.9-57sv","ecosystem":"vendor"},{"name":"sonicwall sma 410 firmware","fixed":[],"affected":"<= 10.2.1.9-57sv","ecosystem":"vendor"},{"name":"sonicwall sma 500v firmware","fixed":[],"affected":"<= 10.2.1.9-57sv","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","self-hosted","sma100","sonicwall","ssl-vpn"],"not_affected_if":["admin-access-restricted","no-sma100-appliance"],"how_to_check":null,"fix":"Apply the mitigations in SonicWall's vendor advisory, or discontinue use of the appliance if mitigations are unavailable (per CISA KEV guidance). Affected and fixed firmware versions: unknown from these sources.","status":"open","published_at":"2023-12-05T21:15:07+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:48:44+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:48:44Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations in SonicWall's vendor advisory, or discontinue use of the appliance if mitigations are unavailable (per CISA KEV guidance). Affected and fixed firmware versions: unknown from these sources.","reach":"unknown","summary":"SonicWall SMA100 SSL-VPN appliances have an OS command injection flaw in the management interface. An attacker with administrator credentials can run arbitrary commands on the appliance as the 'nobody' user.","category":"infrastructure","who_cares":["sonicwall","sma100","ssl-vpn","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary OS commands on the VPN appliance after getting admin login.","analyst_note":"Exploited in the wild per CISA KEV; pull SonicWall's advisory and the affected/fixed firmware versions and the exact mitigation steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-sma100-appliance","admin-access-restricted"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000462,"input_tokens":2573,"output_tokens":409,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':134C '-2023':19A,22A '-44221':20A,23A '200':29A '210':33A '22':133C '400':37A '410':41A '500v':45A 'action':124C 'administr':76B,112C 'allow':14A,106C 'appli':125C 'applianc':62B,84B,91C 'appliances':26A 'applic':131C 'arbitrari':80B,116C 'attack':74B,110C 'authent':17A,109C 'bod':132C 'cisa':122C 'cloud':137C 'command':66B,81B,95C,117C 'contain':92C 'credenti':77B 'cve':18A,21A 'discontinu':140C 'element':5A 'exploit':47B 'firmware':30A,34A,38A,42A,46A 'flaw':68B 'follow':130C 'guidanc':135C 'host':51B 'improp':1A 'infrastructur':48B 'inject':67B,96C,115C 'instruct':129C 'interfac':13A,72B,104C 'manag':12A,71B,103C 'mitig':126C,146C 'neutral':2A 'nobodi':87B,120C 'os':65B,94C 'per':127C 'privileg':113C 'product':144C 'remot':16A,108C 'requir':123C 'run':79B 'self':50B 'self-host':49B 'servic':138C 'sma':28A,32A,36A,40A,44A 'sma100':8A,25A,52B,58B,90C 'sonicwal':53B,57B,89C 'sonicwall':24A,27A,31A,35A,39A,43A 'special':4A 'ssl':10A,55B,60B,101C 'ssl-vpn':9A,54B,59B,100C 'unavail':148C 'use':141C 'user':88B,121C 'vendor':128C 'vpn':11A,56B,61B,102C 'vulner':97C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-12-05T21:15:07+00:00","kev":{"dateAdded":"2025-05-01","dueDate":"2025-05-22","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-44221","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-44221","severity":null,"published_at":"2025-05-01T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:40+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-44221","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44221","severity":null,"published_at":"2023-12-05T21:15:07+00:00","modified_at":"2026-06-17T06:27:09+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}