FlagThis

Cybersecurity firm SonicWall has issued warnings to its customers regarding active exploitation of several vulnerabilities affecting its Secure Mobile Access (SMA) appliances. These vulnerabilities, including CVE-2024-38475, CVE-2023-44221 and CVE-2021-20035 can lead to unauthorized access to files and system compromise. Organizations utilizing SonicWall SMA 100 series appliances are strongly urged to apply the necessary patches immediately to mitigate the risk. The active exploitation highlights the critical need for organizations to maintain up-to-date security measures and promptly address security advisories from vendors.

Specifically, CVE-2024-38475 is a critical severity flaw affecting the mod_rewrite module of Apache HTTP Server, potentially allowing unauthenticated remote attackers to execute code. SonicWall addressed this issue in firmware version 10.2.1.14-75sv and later. CVE-2023-44221, a high-severity command injection flaw, allows attackers with administrative privileges to inject arbitrary commands. CVE-2021-20035, an OS command injection vulnerability, which has been actively exploited in the wild since January 2025.

The exploitation of these vulnerabilities has prompted advisories and updates, including CISA adding CVE-2021-20035 to its Known Exploited Vulnerabilities catalog. Security researchers have observed active scanning for CVE-2021-20016. It is paramount that organizations proactively manage and patch vulnerabilities to protect their networks and sensitive data.

ImgSrc: securityonline.

References :

• The DefendOps Diaries: Understanding SonicWall SMA100 Vulnerabilities: Risks and Mitigation
• BleepingComputer: SonicWall: SMA100 VPN vulnerabilities now exploited in attacks
• Arctic Wolf: SonicWall Updates Advisories for Actively Exploited Vulnerabilities
• isc.sans.edu: Web Scanning Sonicwall for CVE-2021-20016, (Tue, Apr 29th)
• thehackernews.com: SonicWall Confirms Active Exploitation of Flaws Affecting Multiple Appliance Models
• securityonline.info: SonicWall confirms active exploitation of SMA 100 vulnerabilities – urges immediate patching
• Talkback Resources: SonicWall disclosed exploited security flaws in SMA100 Secure Mobile Access appliances, including OS Command Injection and Apache HTTP Server mod_rewrite issues, with patches released in versions 10.2.1.10-62sv and 10.2.1.14-75sv.
• www.bleepingcomputer.com: SonicWall: SMA100 VPN vulnerabilities now exploited in attacks
• arcticwolf.com: Follow-Up: SonicWall Updates Advisories for Actively Exploited Vulnerabilities
• securityonline.info: SecurityOnline
• Talkback Resources: SonicWall Confirms Active Exploitation of Flaws Affecting Multiple Appliance Models [net]
• arcticwolf.com: Follow-Up: SonicWall Updates Advisories for Actively Exploited Vulnerabilities
• es-la.tenable.com: Web Scanning Sonicwall for CVE-2021-20016, (Tue, Apr 29th)
• Arctic Wolf: Follow-Up: SonicWall Updates Advisories for Actively Exploited Vulnerabilities
• bsky.app: Cybersecurity company SonicWall has warned customers that several vulnerabilities impacting its Secure Mobile Access (SMA) appliances are now being actively exploited in attacks.
• securityaffairs.com: SonicWall confirmed that threat actors actively exploited two vulnerabilities impacting its SMA100 Secure Mobile Access (SMA) appliances.
• securityaffairs.com: U.S. CISA adds SonicWall SMA100 and Apache HTTP Server flaws to its Known Exploited Vulnerabilities catalog
• MSSP feed for Latest: SonicWall Flags New Wave of VPN Exploits Targeting SMA Devices
• bsky.app: Security company SonicWall has warned customers that several vulnerabilities impacting its Secure Mobile Access (SMA) appliances are now being actively exploited in attacks.
• Help Net Security: Attackers exploited old flaws to breach SonicWall SMA appliances (CVE-2024-38475, CVE-2023-44221)
• www.scworld.com: SonicWall confirms exploitation of two SMA 100 bugs, one critical
• securityonline.info: SonicWall Issues Patch for SSRF Vulner
• Talkback Resources: Iranian Hackers Maintain 2-Year Access to Middle East CNI via VPN Flaws and Malware [ics] [net] [mal]
• The Hacker News: Iranian Hackers Maintain 2-Year Access to Middle East CNI via VPN Flaws and Malware
• hackread.com: watchTowr Warns of Active Exploitation of SonicWall SMA 100 Devices
• cyberpress.org: CISA Alerts on Active Exploitation of SonicWall SMA100 Command Injection Flaw
• www.helpnetsecurity.com: Attackers exploited old flaws to breach SonicWall SMA appliances.
• watchTowr Labs: SonicBoom, From Stolen Tokens to Remote Shells - SonicWall SMA (CVE-2023-44221, CVE-2024-38475)
• Talkback Resources: Iranian state-sponsored threat group conducted a long-term cyber intrusion targeting critical national infrastructure in the Middle East, exhibiting tradecraft overlaps with Lemon Sandstorm, using custom malware families and sophisticated tactics to maintain persistence and bypass network segmentation.
• Cyber Security News: CISA Alerts on Active Exploitation of SonicWall SMA100 Command Injection Flaw
• securityonline.info: Iranian APT Group Breaches Middle Eastern Critical Infrastructure in Stealth Campaign
• RedPacket Security: SonicWall Products Multiple Vulnerabilities
• thecyberexpress.com: CISA Adds Two Known Exploited Vulnerabilities to Its Catalog: CVE-2024-38475 and CVE-2023-44221
• Cyber Security News: SonicWall Secure Mobile Access (SMA) appliances are under active attack due to two critical vulnerabilities- CVE-2023-44221 (post-authentication command injection) and CVE-2024-38475(pre-authentication arbitrary file read)-being chained to bypass security controls.
• bsky.app: SonicWall urges admins to patch VPN flaw exploited in attacks
• securityonline.info: Multi Vulnerabilities Found in SonicWall SMA 100 Series Prompt Urgent Security Update
• The Hacker News: SonicWall Patches 3 Flaws in SMA 100 Devices Allowing Attackers to Run Code as Root
• BleepingComputer: SonicWall urges admins to patch VPN flaw exploited in attacks
• securityonline.info: SonicWall has released a security advisory detailing multiple vulnerabilities affecting its Secure Mobile Access (SMA) 100 series products.
• MSSP feed for Latest: Exploited SonicWall Flaws Added to KEV List Amid PoC Code Release

Classification:

• HashTags: #SonicWall #Vulnerability #Exploitation
• Company: SonicWall
• Target: SonicWall SMA 100 series appliances
• Product: SMA 100
• Feature: Web Scanning
• Malware: CVE-2021-20016
• Type: Vulnerability
• Severity: High