InfoSecBulletin Cybersecurity for mankind
SonicWall has released patches for three security flaws in SMA 100 Secure Mobile Access appliances that could allow remote code execution.
The vulnerabilities are listed below:
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
CVE-2025-32819 (CVSS score: 8.8) : A vulnerability in SMA100 lets an authenticated remote attacker with SSL-VPN user access bypass checks and delete any file, which could cause the device to reset to factory default settings.
CVE-2025-32820 (CVSS score: 8.3): “A remote attacker with SSL-VPN user privileges can alter directory permissions on the SMA appliance.”
CVE-2025-32821 (CVSS score: 6.7): “A vulnerability in SMA100 allows a remote authenticated attacker with SSL-VPN admin privileges to inject commands and upload a file to the appliance.”
“An attacker with access to an SMA SSL-VPN user account can chain these vulnerabilities to make a sensitive system directory writable, elevate their privileges to SMA administrator, and write an executable file to a system directory,” Rapid7 said in a report. “This chain results in root-level remote code execution.”
CVE-2025-32819 is seen as a way to bypass a fix for a previously found issue reported by NCC Group in December 2021.
Recent weeks have seen active exploitation of several security flaws in SMA 100 Series devices, including CVE-2021-20035, CVE-2023-44221, and CVE-2024-38475. Users should update to the latest version to ensure optimal protection.
Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day
