Old Vulnerability in Sonicwall SMA100 Devices Exploited by Attackers

Recent reports indicate a resurgence of cyberattacks targeting outdated vulnerabilities in the Sonicwall SMA100 series devices. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially included this vulnerability in its Known Exploited Vulnerabilities catalog, alerting organizations to the potential risks.

Sonicwall has also issued an updated advisory acknowledging the ongoing cyber threats associated with this security flaw. Initially identified in September 2021, the vulnerability arises from insufficient filtering of elements within the management interface of the SMA100 series. This allows authenticated attackers to inject arbitrary commands as the user 'nobody', potentially leading to a Denial-of-Service (DoS) condition.

However, Sonicwall's latest assessment has elevated the risk rating from a medium CVSS score of 6.5 to a high score of 7.2. The updated description now indicates that attackers could potentially exploit this vulnerability to execute malicious code rather than merely causing a DoS.

The affected devices within the SMA100 series include models SMA 200, 210, 400, 410, and 500v, which are deployed across various platforms such as ESX, KVM, AWS, and Azure. Sonicwall has released firmware updates (versions 10.2.1.1-19sv, 10.2.0.8-37sv, and 9.0.0.11-31sv and later) that address these vulnerabilities. IT administrators are urged to promptly implement these updates to safeguard their networks.

Details regarding the nature and scope of the observed attacks remain vague, as neither Sonicwall nor CISA has provided specifics on how these intrusions manifest or the extent of their occurrence. Consequently, it remains uncertain how IT professionals can determine whether their systems have been compromised.

Organizations utilizing Sonicwall firewalls should prioritize the installation of the latest updates. Cybercriminals frequently exploit vulnerabilities in these devices to gain unauthorized access to networks. Recent incidents have highlighted the exploitation of a vulnerability in Sonicwall firewalls that allowed attackers to hijack VPN connections.