CVE-2023-5970

🗓️ 05 Dec 2023 20:20:01Reported by sonicwallType

Improper authentication in SMA100 SSL-VPN allows remote attacker to create identical external domain user using accent characters, resulting in MFA bypass

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2023-5970	24 Dec 202315:26	–	circl
CNNVD	SonicWALL SSL-VPN SMA100 series Security Vulnerability	5 Dec 202300:00	–	cnnvd
Cvelist	CVE-2023-5970	5 Dec 202320:20	–	cvelist
NVD	CVE-2023-5970	5 Dec 202321:15	–	nvd
OSV	CVE-2023-5970	5 Dec 202321:15	–	osv
Prion	Authentication flaw	5 Dec 202321:15	–	prion
Positive Technologies	PT-2023-32452 · Sonicwall · Sma100 Ssl-Vpn	5 Dec 202300:00	–	ptsecurity
SonicWall	SonicWall SSL-VPN SMA100 Version 10.x Is Affected By Multiple Vulnerabilities	4 Dec 202315:17	–	sonicwall
Tenable Nessus	SonicWall Secure Mobile Access < 10.2.1.10-62sv (SNWLID-2023-0018)	2 May 202500:00	–	nessus
VulnCheck KEV	VulnCheck KEV: CVE-2023-5970	23 Oct 202500:00	–	vulncheck_kev

NVD

Vulners

Node

sonicwall sma_200_firmwareRange≤10.2.1.9-57sv

AND

sonicwall sma_200Match-

Node

sonicwall sma_210_firmwareRange≤10.2.1.9-57sv

AND

sonicwall sma_210Match-

Node

sonicwall sma_400_firmwareRange≤10.2.1.9-57sv

AND

sonicwall sma_400Match-

Node

sonicwall sma_410_firmwareRange≤10.2.1.9-57sv

AND

sonicwall sma_410Match-

Node

sonicwall sma_500v_firmwareRange≤10.2.1.9-57sv

AND

sonicwall sma_500vMatch-

[
  {
    "defaultStatus": "unknown",
    "platforms": [
      "SMA 200",
      "SMA 210",
      "SMA 400",
      "SMA 410",
      "SMA 500v"
    ],
    "product": "SMA100",
    "vendor": "SonicWall",
    "versions": [
      {
        "status": "affected",
        "version": "10.2.1.9-57sv and earlier versions"
      }
    ]
  }
]

Source	Link
psirt	www.psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018

21 Nov 2024 08:42Current

8.4High risk

Vulners AI Score8.4

CVSS 3.18.8

EPSS0.00567