Two SonicWall SMA100 flaws actively exploited in the wild
May 01, 2025 
SonicWall confirmed that threat actors actively exploited two vulnerabilities impacting its SMA100 Secure Mobile Access (SMA) appliances.
SonicWall revealed that attackers actively exploited two security vulnerabilities, tracked as CVE-2023-44221 and CVE-2024-38475, in its SMA100 Secure Mobile Access appliances.
Below are the descriptions of the two flaws:
- CVE-2023-44221 (CVSS score: 7.2) – Improper neutralization of special elements in the SMA100 SSL-VPN management interface. A remote authenticated attacker with administrative privilege can exploit the flaw to inject arbitrary commands as a ‘nobody’ user, potentially leading to OS Command Injection Vulnerability.
- CVE-2024-38475 (CVSS score: 9.8) – Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier. An attacker can exploit the flaw to map URLs to file system locations that are permitted to be served by the server
“During further analysis, SonicWall and trusted security partners identified an additional exploitation technique using CVE-2024-38475, through which unauthorized access to certain files could enable session hijacking. SMA100 devices updated with the fixed firmware version 10.2.1.14-75sv are not vulnerable to CVE-2024-38475 or the related session hijacking technique described.” reads the advisory updated on April 29, 2025,. “During further analysis, SonicWall and trusted security partners identified that ‘CVE-2023-44221 – Post Authentication OS Command Injection’ vulnerability is potentially being exploited in the wild.”
Both flaws impact SMA 100 Series devices, including SMA 200, 210, 400, 410, 500v. The company addressed the flaws with the following releases:
- CVE-2023-44221 – 10.2.1.10-62sv and higher versions (Fixed on December 4, 2023)
- CVE-2024-38475 – 10.2.1.14-75sv and higher versions (Fixed on December 4, 2024)
The company has not provided technical details about the attacks exploiting the vulnerabilities, nor has it attributed them to any specific threat actor.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, SonicWall)