U.S. CISA adds SonicWall SMA100 Appliance flaw to its Known Exploited Vulnerabilities catalog

CVE-2021-20035 is an OS command injection flaw (CWE-78) caused by improper neutralization of special elements in the management interface of SonicWall SMA100 series appliances. A remote attacker who has authenticated with low-level privileges can inject arbitrary operating system commands, which are executed on the appliance as the 'nobody' user. Per the CVSS scoring, the primary impact is on availability, potentially leading to denial of service, though command execution on the appliance could facilitate further abuse. The flaw affects SMA 200, 210, 400, 410, and 500v firmware. CISA added it to the Known Exploited Vulnerabilities catalog on 2025-04-16, and related reporting describes ongoing attacks against SonicWall SMA 100 devices — including by threat group UNC6148 deploying the OVERSTEP rootkit and tailored backdoor malware, some against fully patched appliances — so defenders should treat this as actively exploited.

Do: Patch to the fixed firmware release specified in the SonicWall advisory for your SMA model as soon as possible; federal agencies must follow the BOD 22-01 mitigation deadline per the CISA KEV required action. Restrict the management interface to trusted networks, enforce MFA on the portal, and hunt for signs of compromise such as the OVERSTEP rootkit, unexpected persistence, or unfamiliar accounts, since reporting indicates tailored backdoor malware in recent SMA 100 attacks.

CVE-2024-53150 is an out-of-bounds read (CWE-125) in the Linux kernel's ALSA USB-audio driver, which fails to validate the bLength field of USB audio class (UAC2/UAC3) clock source, selector, and multiplier descriptors while traversing them. It is triggered when a device presents a malformed/bogus clock descriptor with a bLength shorter than expected, causing the kernel to read beyond the descriptor buffer; an attacker with local access (e.g., by plugging in a malicious USB audio device) could gain partial kernel memory disclosure or crash the system (CVSS 3.1: 7.1, confidentiality high, availability high). Any Linux deployment whose kernel includes the affected ALSA USB-audio clock-source handling is affected, including Debian releases shipping such kernels. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-04-09, indicating exploitation in the wild, though no public proof-of-concept is known and ransomware association is unconfirmed.

Do: Apply updated kernel packages from your distribution (e.g., Debian security updates) that include the ALSA USB-audio clock descriptor validation fix, and reboot to load the patched kernel; CISA KEV requires applying vendor mitigations per BOD 22-01 timelines or discontinuing use if mitigations are unavailable. Until patched, restrict untrusted physical/hotplug access to USB ports on affected systems. Check your current kernel version and confirm with the vendor that the clock-source descriptor sanity-check patch is included.

CVE-2024-53197 is an out-of-bounds access/write (CWE-787) in the Linux kernel's USB configuration handling, tied to the ALSA usb-audio driver's handling of Creative Extigy and Mbox devices. A malicious or bogus USB device that reports a bNumConfigurations value larger than the array allocated by usb_get_configuration causes the kernel to access memory beyond the end of dev->config, for example in usb_destroy_configuration. An attacker with local access — or the ability to plug a crafted USB audio device into a target — could corrupt or disclose kernel memory, with high impact to confidentiality, integrity, and availability (CVSS 7.8, local vector), typically as privilege escalation or a kernel crash. Any Linux deployment running a kernel with the vulnerable code is affected, including Debian systems. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-04-09, indicating known exploitation in the wild, though no public proof-of-concept is known and ransomware use is unconfirmed.

Do: Update the Linux kernel to a vendor release containing the CVE-2024-53197 fix — for Debian, install the current kernel security update and reboot; other distributions ship the patched kernel in their stable updates. Because exploitation requires a malicious USB audio device, restrict use of untrusted USB peripherals on sensitive or internet-adjacent hosts. Organizations subject to CISA BOD 22-01 must remediate this KEV-listed flaw per the required actions or discontinue use where mitigations are unavailable.

CVE-2025-29824 is a use-after-free flaw (CWE-416) in the Windows Common Log File System (CLFS) kernel driver, scored 7.8 (High) with a local attack vector, low privileges required, and no user interaction. An authorized local attacker can trigger it by interacting with CLFS-managed log files in a way that references freed kernel memory. Successful exploitation elevates the attacker's local privileges, typically to SYSTEM, providing full control of the host that can be chained into ransomware deployment or lateral movement. Any unpatched system running the listed Windows 10, Windows 11, or Windows Server versions is affected. The flaw was exploited as a zero-day — reportedly by Play ransomware — before Microsoft shipped fixes in the April 2025 Patch Tuesday release; it was added to CISA's KEV catalog on 2025-04-08 with known ransomware use, and EPSS estimates a 13.9% probability of continued exploitation over 30 days (96th percentile).

Do: Apply Microsoft's April 2025 Patch Tuesday security updates for your Windows version immediately — the vendor update is the only complete fix, and the flaw is on the KEV list with known ransomware use, so prioritize servers and endpoints used by privileged users. Until patched, limit untrusted local code execution and review hosts for post-exploitation privilege escalation; public detection and mitigation scripts (e.g., Vicarius) are available to help hunt for exploitation. Federal agencies must apply the vendor mitigations per BOD 22-01 deadlines or discontinue use of affected versions.

Gladinet CentreStack (and, per CISA, the companion product Triofox) ships with a hard-coded ASP.NET machineKey in the portal's web.config, which is used to protect ViewState and similar serialized data. An attacker who knows this fixed key can craft a serialized payload and submit it to the network-facing portal, where server-side deserialization executes it, yielding unauthenticated remote code execution (CVSS 9.8, no privileges or user interaction required). Successful RCE gives attackers full control of the file-sharing server (high confidentiality, integrity and availability impact); public reporting indicates attackers have abused the flaw to gain unauthorized access and install remote access tools. Anyone running the affected CentreStack builds is exposed, with self-hosted deployments at SMBs and MSP-hosted environments the typical footprint. The flaw was exploited in the wild in March 2025, was added to CISA's Known Exploited Vulnerabilities catalog on 2025-04-08, and carries an EPSS of 94.3% (100th percentile).

Do: Upgrade CentreStack to 16.4.10315.56368 or later, and apply the equivalent vendor fix for Triofox; as an interim mitigation, administrators can delete the hard-coded machineKey defined in portal\web.config so it is regenerated. Because the flaw is actively exploited, review portals for signs of compromise (unexpected accounts, unfamiliar processes or remote access tools) and, for federal agencies, follow the applicable BOD 22-01 required actions.