InfoSecBulletin Cybersecurity for mankind
On April 29, 2025, SonicWall announced that two previously disclosed vulnerabilities in its SMA 100 Series appliances are being actively exploited. They urge customers to update to the latest secure firmware to avoid compromise.
First identified in December 2023, CVE-2023-44221 has now been confirmed as under active exploitation. The vulnerability—assigned a CVSS score of 7.2—arises from “improper neutralization of special elements in the SMA100 SSL-VPN management interface,” according to SonicWall’s PSIRT advisory.
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
This flaw lets a remote attacker with admin rights inject OS commands as the ‘nobody’ user. If exploited, it can result in full OS command execution, compromising system confidentiality and integrity.
“During further analysis, SonicWall and trusted security partners identified that CVE-2023-44221 is potentially being exploited in the wild,” the company confirmed. “SMA100 devices updated with the fixed firmware version 10.2.1.10-62sv or latest release version are not vulnerable to CVE-2023-44221 exploitation.”
Impacted Versions:
SMA 100 Series (Models: 200, 210, 400, 410, 500v) running firmware 10.2.1.9-57sv and earlier
Fixed Version:
Firmware 10.2.1.10-62sv and above
A second critical vulnerability, CVE-2024-38475 (CVSS 9.8), is caused by a flaw that allows unauthorized access due to improper handling in a part of the Apache HTTP Server.
The vulnerability lets attackers manipulate URLs to bypass directory restrictions and access protected file system paths. SonicWall warns that this flaw could be exploited to hijack user sessions in certain situations.
“SonicWall and trusted security partners identified an additional exploitation technique using CVE-2024-38475, through which unauthorized access to certain files could enable session hijacking,” SonicWall said in the advisory. “SMA100 devices updated with firmware version 10.2.1.14-75sv are not vulnerable to CVE-2024-38475 or the related session hijacking technique.”
Impacted Versions:
SMA 100 Series (Models: 200, 210, 400, 410, 500v) running firmware 10.2.1.13-72sv and earlier
Fixed Version:
Firmware 10.2.1.14-75sv and above
SonicWall urges all customers using SMA 100 series devices to:
Update to the latest firmware to address vulnerabilities. Check admin login activity for unauthorized access. Monitor system logs and traffic for unusual behavior.
