CVE-2023-44221
SonicWall SMA100 Appliances OS Command Injection Vulnerability
Published Dec 5, 2023 · updated Jun 16, 2026 · sonicwall sma 200 firmware
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Dec 5, 2023 · Catalog
Detected
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
May 1, 2025 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
May 22, 2025 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date May 22, 2025
Affected
- cpe sonicwall/sma 200 firmwareversion unspecified
- cpe sonicwall/sma 210 firmwareversion unspecified
- cpe sonicwall/sma 400 firmwareversion unspecified
- cpe sonicwall/sma 410 firmwareversion unspecified
- cpe sonicwall/sma 500v firmwareversion unspecified
- vendor SonicWall SMA100 Appliancesversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2023-44221
SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.
cisa.gov - CVE.orgVulnerability recordCVE-2023-44221
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2023-44221
30-day exploitation probability 76.3%
first.org - NIST NVDVulnerability recordCVE-2023-44221
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
nvd.nist.gov