InfoSecBulletin Cybersecurity for mankind
On April 29, 2025, SonicWall announced that two previously disclosed vulnerabilities in its SMA 100 Series appliances are being actively exploited. They urge customers to update to the latest secure firmware to avoid compromise.
First identified in December 2023, CVE-2023-44221 has now been confirmed as under active exploitation. The vulnerability—assigned a CVSS score of 7.2—arises from “improper neutralization of special elements in the SMA100 SSL-VPN management interface,” according to SonicWall’s PSIRT advisory.
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
This flaw lets a remote attacker with admin rights inject OS commands as the ‘nobody’ user. If exploited, it can result in full OS command execution, compromising system confidentiality and integrity.
“During further analysis, SonicWall and trusted security partners identified that CVE-2023-44221 is potentially being exploited in the wild,” the company confirmed. “SMA100 devices updated with the fixed firmware version 10.2.1.10-62sv or latest release version are not vulnerable to CVE-2023-44221 exploitation.”
Impacted Versions:
SMA 100 Series (Models: 200, 210, 400, 410, 500v) running firmware 10.2.1.9-57sv and earlier
Fixed Version:
Firmware 10.2.1.10-62sv and above
A second critical vulnerability, CVE-2024-38475 (CVSS 9.8), is caused by a flaw that allows unauthorized access due to improper handling in a part of the Apache HTTP Server.
The vulnerability lets attackers manipulate URLs to bypass directory restrictions and access protected file system paths. SonicWall warns that this flaw could be exploited to hijack user sessions in certain situations.
“SonicWall and trusted security partners identified an additional exploitation technique using CVE-2024-38475, through which unauthorized access to certain files could enable session hijacking,” SonicWall said in the advisory. “SMA100 devices updated with firmware version 10.2.1.14-75sv are not vulnerable to CVE-2024-38475 or the related session hijacking technique.”
Impacted Versions:
SMA 100 Series (Models: 200, 210, 400, 410, 500v) running firmware 10.2.1.13-72sv and earlier
Fixed Version:
Firmware 10.2.1.14-75sv and above
SonicWall urges all customers using SMA 100 series devices to:
Update to the latest firmware to address vulnerabilities. Check admin login activity for unauthorized access. Monitor system logs and traffic for unusual behavior.
