SonicWall · SMA100 Appliances
CVE-2023-44221
SonicWall SMA100 Appliances OS Command Injection Vulnerability
What it is
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
CISA: SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: May 22, 2025
More exploited flaws from SonicWall
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 16, 2025 | OS Command Injection | SMA100 Appliances | Medium 6.5 | 4.4% |
| Sep 2, 2026 | Server-Side Request Forgery | SMA1000 Appliances | Critical 10.0 | 8.0% |
| Sep 2, 2026 | OS Command Injection | SMA1000 Appliances | High 7.8 | 9.9% |
| Jul 14, 2026 | Server-Side Request Forgery | SMA1000 Appliances | Critical 10.0 | 6.8% |
| Jul 14, 2026 | Code Injection | SMA1000 Appliances | High 7.2 | 12% |
| Dec 17, 2025 | SMA1000 Missing Authorization | SMA1000 appliance | Medium 6.6 | 2.8% |
| Feb 18, 2025 | SSLVPN Improper Authentication | SonicOS | High 8.2 | 95% |
| Jan 24, 2025 | Deserialization | SMA1000 Appliances | Critical 9.8 | 23% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.