InfoSecBulletin Cybersecurity for mankind
On April 29, 2025, SonicWall announced that two previously disclosed vulnerabilities in its SMA 100 Series appliances are being actively exploited. They urge customers to update to the latest secure firmware to avoid compromise.
First identified in December 2023, CVE-2023-44221 has now been confirmed as under active exploitation. The vulnerability—assigned a CVSS score of 7.2—arises from “improper neutralization of special elements in the SMA100 SSL-VPN management interface,” according to SonicWall’s PSIRT advisory.
SoftBank: Over 137,000 personal info leaked
Alert
Trend Micro Apex One Flaw Allow Attackers to Inject Malicious Code
Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Action
Adobe Releases Patch Fixing 254 Vulnerabilities With High-Severity Security Gaps
Alert
40,000 + live internet cameras exposed globally !
Microsoft patch Tuesday fix exploited zero-day and 65 vuls patched
84,000+ Roundcube instances vulnerable to actively exploited flaw
CVE-2025-24016
Critical Wazuh RCE Actively Exploited by Mirai Botnets
CISA Issues Seven Advisories for Industrial Control Systems (ICS)
ClickFix Attack Exploits Fake Cloudflare Human Check to Install Malware
This flaw lets a remote attacker with admin rights inject OS commands as the ‘nobody’ user. If exploited, it can result in full OS command execution, compromising system confidentiality and integrity.
“During further analysis, SonicWall and trusted security partners identified that CVE-2023-44221 is potentially being exploited in the wild,” the company confirmed. “SMA100 devices updated with the fixed firmware version 10.2.1.10-62sv or latest release version are not vulnerable to CVE-2023-44221 exploitation.”
Impacted Versions:
SMA 100 Series (Models: 200, 210, 400, 410, 500v) running firmware 10.2.1.9-57sv and earlier
Fixed Version:
Firmware 10.2.1.10-62sv and above
A second critical vulnerability, CVE-2024-38475 (CVSS 9.8), is caused by a flaw that allows unauthorized access due to improper handling in a part of the Apache HTTP Server.
The vulnerability lets attackers manipulate URLs to bypass directory restrictions and access protected file system paths. SonicWall warns that this flaw could be exploited to hijack user sessions in certain situations.
“SonicWall and trusted security partners identified an additional exploitation technique using CVE-2024-38475, through which unauthorized access to certain files could enable session hijacking,” SonicWall said in the advisory. “SMA100 devices updated with firmware version 10.2.1.14-75sv are not vulnerable to CVE-2024-38475 or the related session hijacking technique.”
Impacted Versions:
SMA 100 Series (Models: 200, 210, 400, 410, 500v) running firmware 10.2.1.13-72sv and earlier
Fixed Version:
Firmware 10.2.1.14-75sv and above
SonicWall urges all customers using SMA 100 series devices to:
Update to the latest firmware to address vulnerabilities. Check admin login activity for unauthorized access. Monitor system logs and traffic for unusual behavior.
