Command injection

2023-12-0521:15:00

PRIOn knowledge base

www.prio-n.com

command injection

sma100 ssl-vpn

remote attacker

administrative privilege

os command injection

7.6 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

33.0%

JSON

Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a ‘nobody’ user, potentially leading to OS Command Injection Vulnerability.

CPENameOperatorVersion
sma_200_firmwareeq<= 10.2.1.9-57sv
sma_210_firmwareeq<= 10.2.1.9-57sv
sma_400_firmwareeq<= 10.2.1.9-57sv
sma_410_firmwareeq<= 10.2.1.9-57sv
sma_500v_firmwareeq<= 10.2.1.9-57sv

Name	Operator	Version
sma_200_firmware	eq	<= 10.2.1.9-57sv
sma_210_firmware	eq	<= 10.2.1.9-57sv
sma_400_firmware	eq	<= 10.2.1.9-57sv
sma_410_firmware	eq	<= 10.2.1.9-57sv
sma_500v_firmware	eq	<= 10.2.1.9-57sv

References

psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018