CISA Confirms Exploitation of SonicWall Vulnerabilities
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-44221 | OS Command Injection in SonicWall SMA100 SSL-VPN Management Interface | 7.2 | 76% | KEV | KEV |
| CVE-2024-38475 | Improper Output Escaping in Apache HTTP Server mod_rewrite Enables File Disclosure/Code Execution | 9.1 | 100% | KEV | KEV |
From the original article
2 min read at infosecurity-magazine.com
Edge security provider SonicWall faces a new wave of vulnerabilities affecting its products, which are being exploited in the wild. On May 1, the US Cybersecurity and Infrastructure Security Agency (CISA) added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, CVE-2023-44221 and CVE-2024-38475. CVE-2023-44221: SonicWall’s 2023 Post-Authentication Command Injection
By Kevin Poireault · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.