SonicWall this week warned of the in-the-wild exploitation of two vulnerabilities impacting its Secure Mobile Access (SMA) 100 Series products.
The first security defect, tracked as CVE-2023-44221 (CVSS score of 7.2), is described as an OS command injection bug that could be exploited remotely. Successful exploitation, however, requires administrative privileges.
The second issue, CVE-2024-38475 (CVSS score of 9.8), is a critical-severity path traversal flaw in Apache HTTP Server that “allows an attacker to map URLs to file system locations that are permitted to be served by the server.” It can be exploited remotely, without authentication.
The two vulnerabilities affect SonicWall’s SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v secure remote access products and were addressed in December 2023 and December 2024 in software versions 10.2.1.10-62sv and 10.2.1.14-75sv, respectively.
SonicWall updated its advisories for both flaws this week, to warn that they have been exploited in the wild. For CVE-2024-38475, the company also warned of an additional exploitation technique that could lead to session hijacking, if the attacker has access to certain files.
The company urges customers to update their appliances to the latest software releases, which contain patches for both issues.
SonicWall warned of CVE-2023-44221 and CVE-2024-38475 being exploited roughly two weeks after it warned that an old SMA 100 series bug, tracked as CVE-2021-20035, has been exploited in attacks.
Simultaneously with SonicWall updating its advisory for CVE-2021-20035, the US cybersecurity agency CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog.
Threat actors are known to have targeted SMA 100 appliances in attacks, including through the exploitation of zero-day vulnerabilities.
Related: SonicWall Patches High-Severity Vulnerability in NetExtender
Related: SonicWall Firewall Vulnerability Exploited After PoC Publication
Related: SonicWall Confirms Exploitation of New SMA Zero-Day
Related: SonicWall Learns From Microsoft About Potentially Exploited Zero-Day