CISA Confirms Exploitation of SonicWall Vulnerabilities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-44221 | OS Command Injection in SonicWall SMA100 SSL-VPN Management Interface SonicWall SMA100 appliances contain an OS command injection flaw (CWE-78) caused by improper neutralization of special elements in the SSL-VPN management interface. A remote attacker who is already authenticated with administrative privileges can submit crafted input containing special characters, causing arbitrary operating system commands to be executed on the appliance. Injected commands run as the low-privilege 'nobody' user, which limits immediate access but still yields high-impact confidentiality, integrity, and availability outcomes (CVSS 7.2) and can provide a foothold for further compromise. Affected products are the SMA 200, SMA 210, SMA 400, and SMA 410 appliance firmware and the SMA 500v virtual appliance firmware. The flaw carries a high EPSS score (75.1%, 99th percentile), was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-01, and reporting indicates both SonicWall and CISA have confirmed active in-the-wild exploitation of this and related SMA100 flaws. Do: Upgrade affected SMA100 appliances (SMA 200/210/400/410 and SMA 500v) to the latest vendor-patched firmware per SonicWall's advisory, as required under CISA KEV/BOD 22-01 timelines. Until patched, restrict access to the SSL-VPN management interface to trusted networks and enforce MFA on administrative accounts, since exploitation requires an authenticated administrative session. Given confirmed in-the-wild exploitation, review appliance logs for unauthorized administrative activity or command execution and rotate credentials if compromise is suspected. | 7.2 | 76% | KEV |
| large≈tens of thousands of internet-exposed SMA100 SSL-VPN appliances (order 10k–100k) | |
| CVE-2024-38475 | Improper Output Escaping in Apache HTTP Server mod_rewrite Enables File Disclosure/Code Execution CVE-2024-38475 is an improper escaping of output flaw (CWE-116) in the mod_rewrite module of the Apache HTTP Server. It is triggered when mod_rewrite maps a request URL to a filesystem location and mishandles encoded characters, allowing a crafted request to reach files that the server is permitted to serve but that were never intentionally or directly reachable by any URL. An attacker can abuse this to disclose source code (for example, serving raw application files) or, depending on the server's configuration and handlers, achieve code execution. Any Apache HTTP Server deployment that uses mod_rewrite is potentially affected; the source data does not specify the vulnerable version range. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-01, confirming exploitation in the wild, and EPSS assigns it a 100% probability of exploitation within 30 days (100th percentile), though no public proof-of-concept is known and ransomware use is unconfirmed. Do: Inventory Apache HTTP Server deployments, prioritize internet-facing ones, and check whether mod_rewrite is in use (RewriteRule directives in server config, virtual hosts, or .htaccess files); upgrade to the vendor's fixed release, 2.4.60 or later. If immediate upgrade is not possible, follow vendor guidance to harden or constrain mod_rewrite rules, and treat the issue as actively exploited per CISA KEV, applying BOD 22-01 mitigations for cloud service usage or discontinuing use if mitigation is unavailable. | 9.1 | 100% | KEV |
| masslikely hundreds of thousands to over a million internet-exposed Apache HTTP Server instances, with only the mod_rewrite-enabled subset vulnerable |
Full article557 words · extracted from infosecurity-magazine.com · click to collapse
Written by
Edge security provider SonicWall faces a new wave of vulnerabilities affecting its products, which are being exploited in the wild.
On May 1, the US Cybersecurity and Infrastructure Security Agency (CISA) added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, CVE-2023-44221 and CVE-2024-38475.
CVE-2023-44221: SonicWall’s 2023 Post-Authentication Command Injection
CVE-2023-44221 is a post-authentication command injection vulnerability caused by improper neutralization of special elements in SonicWall’s Secure Mobile Access (SMA), specifically the SMA 100 SSL-VPN management interface.
When exploited, this high-severity flaw (CVSS 3.1 base score of 7.2) allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user. It affects SMA 200, SMA 210, SMA 400, SMA 410 and SMA 500v.
It was detected by a security researcher, Wenjie Zhong (also known as H4lo) from DBappSecurity Co., Ltd’s Webin lab, and was disclosed by SonicWall, a CVE Numbering Authority (CNA), in December 2023.
The SonicWall also released a fix in SMA 100 series version 10.2.1.10-62sv and higher and shared it in a security advisory also published in December 2023.
In an advisory update on April 29, 2025, SonicWall confirmed CVE-2023-44221 is “potentially being exploited in the wild.”
This exploitation has now been confirmed by CISA.
CVE-2024-38475: Apache HTTP Server’s 2024 Pre-Authentication Arbitrary File Read
CVE-2024-38475 is a pre-authentication arbitrary file read affecting Apache HTTP Server.
It was first disclosed by Orange Tsai, the Principal Security Researcher at Devcore, at Black Hat USA 2024 as one of nine different vulnerabilities in the Apache HTTP Server.
— Orange Tsai 🍊 (@orange_8361) August 9, 2024Thrilled to release my latest research on Apache HTTP Server, revealing several architectural issues! https://t.co/YzYcwxOGBn
Highlights include:
⚡ Escaping from DocumentRoot to System Root
⚡ Bypassing built-in ACL/Auth with just a '?'
⚡ Turning XSS into RCE with legacy code…
CVE-2024-38475 is a critical flaw (CVSS 3.1 base score of 9.8) caused by improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier. When exploited, it allows an attacker to map URLs to file system locations that are permitted to be served by the server.
Despite officially appearing as an Apache vulnerability, CVE-2024-38475 also affects SonicWall’s SMA 100 Series (SMA 200, 210, 400, 410 and 500v) for version 10.2.1.13-72sv and earlier, explained WatchTowr Labs in a new report about the two vulnerabilities, published on May 2, 2025.
“Although this is a CVE attached to the Apache HTTP Server, it is important to note that due to how CVEs are now assigned, a separate CVE will not be assigned for SonicWall's usage of the vulnerable version,” the WatchTowr report reads. “This makes the situation confusing for those responding to CISA's KEV listing - CISA is referring to the two vulnerabilities in combination being used to attack SonicWall devices.”
CVE-2024-38475 was disclosed by the Apache Software Foundation, another CNA, in July 2024.
In December 2024, SonicWall released a security advisory addressing six vulnerabilities affecting its SMA 100 series, including CVE-2024-38475.
The advisory includes a fix in SMA 100 series 10.2.1.14-75sv and higher.
SonicWall updated the advisory on April 29, 2025, to warn users that CVE-2024-38475 and the five related flaws could be exploited in the wild.
WatchTowr shared a proof-of-concept (poC) chaining exploit for CVE-2023-44221 and CVE-2024-38475 in its report.
Photo credits: Michael Vi/Tada Images/Shutterstock
Read now: Palo Alto Networks and SonicWall Firewalls Under Attack
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/cisa-exploitation-sonicwall/