On Wednesday, CISA warned federal businesses to safe their SonicWall Safe Cellular Entry (SMA) 100 sequence home equipment in opposition to assaults exploiting a high-severity distant code execution vulnerability.
Tracked as CVE-2021-20035, this safety flaw impacts SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v (ESX, KVM, AWS, Azure) units. Profitable exploitation can enable distant risk actors with low privileges to execute arbitrary code in low-complexity assaults.
“Improper neutralization of particular parts within the SMA100 administration interface permits a distant authenticated attacker to inject arbitrary instructions as a ‘no person’ consumer, which may doubtlessly result in code execution,” SonicWall explains in an advisory up to date this week.
SonicWall patched this vulnerability nearly 4 years in the past, in September 2021, when the corporate stated it may solely be exploited to take down weak home equipment in denial-of-service (DoS) assaults.
Nonetheless, it up to date the CVE-2021-20035 safety advisory on Monday to flag it as exploited in assaults and broaden the impression to incorporate code execution.
“This vulnerability is believed to be actively exploited within the wild. As a precautionary measure, SonicWall PSIRT has up to date the abstract and revised the CVSS rating to 7.2,” SonicWall stated.
| Product | Platform | Impacted Model | Fastened model |
| SMA 100 Collection | • SMA 200 • SMA 210 • SMA 400 • SMA 410 • SMA 500v (ESX, KVM, AWS, Azure) |
10.2.1.0-17sv and earlier | 10.2.1.1-19sv and better |
| 10.2.0.7-34sv and earlier | 10.2.0.8-37sv and better | ||
| 9.0.0.10-28sv and earlier | 9.0.0.11-31sv and better |
Yesterday, CISA confirmed the vulnerability is now being abused within the wild by including it to the Recognized Exploited Vulnerabilities catalog, which lists safety flaws flagged by the cybersecurity company as actively exploited in assaults.
As mandated by the Binding Operational Directive (BOD) 22-01 issued in November 2021, Federal Civilian Govt Department (FCEB) businesses now have three weeks, till Might seventh, to safe their networks in opposition to ongoing assaults.
Whereas BOD 22-01 solely applies to U.S. federal businesses, all community defenders ought to prioritize patching this safety vulnerability as quickly as doable to dam potential breach makes an attempt.
“Most of these vulnerabilities are frequent assault vectors for malicious cyber actors and pose vital dangers to the federal enterprise,” CISA warned.
In February, SonicWall additionally warned of an actively exploited authentication bypass flaw in Gen 6 and Gen 7 firewalls that would let hackers hijack VPN classes.
One month earlier, the corporate urged clients to patch a crucial vulnerability affecting SMA1000 safe entry gateways following reviews that it had already been exploited in zero-day assaults.
