UNC6148 Backdoors Fully-Patched SonicWall SMA 100 Series Devices with OVERSTEP Rootkit
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-20035 | Authenticated OS Command Injection in SonicWall SMA100 Appliances CVE-2021-20035 is an OS command injection flaw (CWE-78) caused by improper neutralization of special elements in the management interface of SonicWall SMA100 series appliances. A remote attacker who has authenticated with low-level privileges can inject arbitrary operating system commands, which are executed on the appliance as the 'nobody' user. Per the CVSS scoring, the primary impact is on availability, potentially leading to denial of service, though command execution on the appliance could facilitate further abuse. The flaw affects SMA 200, 210, 400, 410, and 500v firmware. CISA added it to the Known Exploited Vulnerabilities catalog on 2025-04-16, and related reporting describes ongoing attacks against SonicWall SMA 100 devices — including by threat group UNC6148 deploying the OVERSTEP rootkit and tailored backdoor malware, some against fully patched appliances — so defenders should treat this as actively exploited. Do: Patch to the fixed firmware release specified in the SonicWall advisory for your SMA model as soon as possible; federal agencies must follow the BOD 22-01 mitigation deadline per the CISA KEV required action. Restrict the management interface to trusted networks, enforce MFA on the portal, and hunt for signs of compromise such as the OVERSTEP rootkit, unexpected persistence, or unfamiliar accounts, since reporting indicates tailored backdoor malware in recent SMA 100 attacks. | 6.5 | 4% | KEV |
| large≈ tens of thousands of internet-exposed SMA 100-series appliances (order of magnitude 10k–100k) | |
| CVE-2021-20038 | Unauthenticated Stack Buffer Overflow in SonicWall SMA 100 Appliances SonicWall SMA 100 series secure remote-access appliances contain an unauthenticated stack-based buffer overflow (CWE-121) in the appliance's network-facing interface, triggered by crafted requests sent to the device without any credentials. A remote attacker who triggers the overflow can execute arbitrary code on the appliance with the privileges of the affected service, gaining a foothold on an internet-facing VPN gateway that typically sits at the network edge. Any organization running an SMA 100 series appliance is affected, and because these appliances provide remote access to corporate networks, compromise can expose entire internal environments. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2022-01-28 with known ransomware use, and EPSS assigns a 99.9% probability of exploitation within 30 days (100th percentile). No public proof-of-concept is catalogued in the provided data, but the KEV listing and EPSS score indicate active attacker interest. Do: Upgrade SMA 100 series appliances to firmware 10.0.7.2 or later per SonicWall's instructions, as required by the CISA KEV listing. Until patched, restrict internet exposure of the SMA portal and management interface to trusted sources where feasible. Because ransomware operators are known to exploit this flaw, review appliance logs for signs of compromise and monitor for unexpected account creation or traffic after patching. | 9.8 | 100% | KEV ransomware PoC ×2 |
| largetens of thousands of internet-exposed SMA 100 appliances (order of magnitude ~10,000-50,000 devices), plus a larger installed base used internally | |
| CVE-2021-20039 | Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to in Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances. NVD description · AI analysis pending | 8.8 | 79% | PoC |
| — | |
| CVE-2024-38475 | Improper Output Escaping in Apache HTTP Server mod_rewrite Enables File Disclosure/Code Execution CVE-2024-38475 is an improper escaping of output flaw (CWE-116) in the mod_rewrite module of the Apache HTTP Server. It is triggered when mod_rewrite maps a request URL to a filesystem location and mishandles encoded characters, allowing a crafted request to reach files that the server is permitted to serve but that were never intentionally or directly reachable by any URL. An attacker can abuse this to disclose source code (for example, serving raw application files) or, depending on the server's configuration and handlers, achieve code execution. Any Apache HTTP Server deployment that uses mod_rewrite is potentially affected; the source data does not specify the vulnerable version range. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-01, confirming exploitation in the wild, and EPSS assigns it a 100% probability of exploitation within 30 days (100th percentile), though no public proof-of-concept is known and ransomware use is unconfirmed. Do: Inventory Apache HTTP Server deployments, prioritize internet-facing ones, and check whether mod_rewrite is in use (RewriteRule directives in server config, virtual hosts, or .htaccess files); upgrade to the vendor's fixed release, 2.4.60 or later. If immediate upgrade is not possible, follow vendor guidance to harden or constrain mod_rewrite rules, and treat the issue as actively exploited per CISA KEV, applying BOD 22-01 mitigations for cloud service usage or discontinuing use if mitigation is unavailable. | 9.1 | 100% | KEV |
| masslikely hundreds of thousands to over a million internet-exposed Apache HTTP Server instances, with only the mod_rewrite-enabled subset vulnerable | |
| CVE-2025-32819 | A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file po A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings. NVD description · AI analysis pending | 8.8 | 6% | PoC |
| — |
Full article1,050 words · extracted from thehackernews.com · click to collapse
A threat activity cluster has been observed targeting fully-patched end-of-life SonicWall Secure Mobile Access (SMA) 100 series appliances as part of a campaign designed to drop a backdoor called OVERSTEP.
The malicious activity, dating back to at least October 2024, has been attributed by the Google Threat Intelligence Group (GTIG) to a hacking crew it tracks as UNC6148. The number of known victims is "limited" at this stage.
The tech giant assessed with high confidence that the threat actor is "leveraging credentials and one-time password (OTP) seeds stolen during previous intrusions, allowing them to regain access even after organizations have applied security updates."
"Analysis of network traffic metadata records suggests that UNC6148 may have initially exfiltrated these credentials from the SMA appliance as early as January 2025."
The exact initial access vector used to deliver the malware is currently not known due to the steps taken by the threat actors to remove log entries. But it's believed that access may have been gained through the exploitation of known security flaws such as CVE-2021-20035, CVE-2021-20038, CVE-2021-20039, CVE-2024-38475, or CVE-2025-32819.
Alternately, the tech giant's threat intelligence team theorized that the administrator credentials could've been obtained through information-stealing logs or acquired from credential marketplaces. However, it said it didn't find any evidence to back up this hypothesis.
Upon gaining access, the threat actors have been found to establish an SSL-VPN session and spawn a reverse shell, although how this was achieved remains a mystery given that shell access should not be possible by design on these appliances. It's believed that it may have been pulled off by means of a zero-day flaw.
The reverse shell is used to run reconnaissance and file manipulation commands, not to mention export and import settings to the SMA appliance, suggesting that UNC6148 may have altered an exported settings file offline to include new rules so that their operations are not interrupted or blocked by the access gateways.
The attacks culminate in the deployment of a previously undocumented implant named OVERSTEP that's capable of modifying the appliance's boot process to maintain persistent access, as well as credential theft and concealing its own components to evade detection by patching various file system-related functions.
This is achieved by implementing a usermode rootkit through the hijacked standard library functions open and readdir, allowing it to hide the artifacts associated with the attack. The malware also hooks into the write API function to receive commands from an attacker-controlled server in the form of embedded within web requests -
- dobackshell, which starts a reverse shell to the specified IP address and port
- dopasswords, which creates a TAR archive of the files /tmp/temp.db, /etc/EasyAccess/var/conf/persist.db, and /etc/EasyAccess/var/cert, and save it in the location "/usr/src/EasyAccess/www/htdocs/" so that it can be downloaded via a web browser
"UNC6148 modified the legitimate RC file '/etc/rc.d/rc.fwboot' to achieve persistence for OVERSTEP," GTIG said. "The changes meant that whenever the appliance was rebooted, the OVERSTEP binary would be loaded into the running file system on the appliance."
Once the deployment step is complete, the threat actor then proceeds to clear the system logs and reboots the firewall to activate the execution of the C-based backdoor. The malware also attempts to remove the command execution traces from different log files, including httpd.log, http_request.log, and inotify.log.
"The actor's success in hiding their tracks is largely due to OVERSTEP's capability to selectively delete log entries [from the three log files]," Google said. "This anti-forensic measure, combined with a lack of shell history on disk, significantly reduces visibility into the actor's secondary objectives."
Google has evaluated with medium confidence that UNC6148 may have weaponized an unknown, zero-day remote code execution vulnerability to deploy OVERSTEP on targeted SonicWall SMA appliances. Furthermore, it's suspected that the operations are carried out with the intent to facilitate data theft and extortion operations, and even ransomware deployment.
This connection stems from the fact that one of the organizations that was targeted by UNC6148 was posted on the data leak site operated by World Leaks, an extortion gang run by individuals previously associated with the Hunters International ransomware scheme. It's worth noting that Hunters International recently shuttered its criminal enterprise.
According to Google, UNC6148 exhibits tactical overlaps with prior exploitation of SonicWall SMA devices observed in July 2023 that involved an unknown threat actor deploying a web shell, a hiding mechanism, and a way to ensure persistence across firmware upgrades, per Truesec.
The exploitation activity was subsequently linked by security researcher Stephan Berger to the deployment of the Abyss ransomware.
The findings once again highlight how threat actors are increasingly focusing on edge network systems that aren't usually covered by common security tools like Endpoint Detection and Response (EDR) or antivirus software and slip into target networks unnoticed.
"Organizations should acquire disk images for forensic analysis to avoid interference from the rootkit anti-forensic capabilities. Organizations may need to engage with SonicWall to capture disk images from physical appliances," Google said.
When reached for comment on the findings, SonicWall told The Hacker News that it has been "working closely" with GTIG throughout the whole process, and that it plans to accelerate the end-of-support date for the SMA 100 series. It also said it intends to support existing SMA 100 deployments with firmware updates throughout the remaining lifecycle.
"In response to the evolving threat landscape – and in alignment with our commitment to transparency and customer protection – SonicWall will accelerate the end-of-support date for the SMA 100 series," the company said. "The SMA 100 has already reached end-of-sale status, as reflected in our Product Lifecycle Table, and this update aligns with our long-term strategy and industry direction."
"SonicWall has been actively guiding customers toward more modern, secure solutions such as our Cloud Secure Edge service and the SMA 1000 series. These platforms are built on advanced technology stacks and offer stronger security, greater scalability, and an improved user experience – better suited for today's distributed and cloud-connected environments. This mirrors broader industry trends, where leading vendors like Cisco and Palo Alto Networks have moved customers from legacy hardware to cloud-native architectures."
(The story was updated after publication to include a response from SonicWall.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/07/unc6148-backdoors-fully-patched.html