“During further analysis, SonicWall and trusted security partners identified that ‘CVE-2023-44221 – Post Authentication OS Command Injection’ vulnerability is potentially being exploited in the wild,” SonicWall stated in an updated advisory issued on April 30, 2025. To further protect against potential exploitation, security experts recommend implementing multi-factor authentication for all accounts, especially local accounts, resetting passwords of all local accounts on SonicWall SMA firewalls with strong passwords, limiting VPN access to only necessary accounts, and removing or disabling unneeded accounts, including default admin accounts. “Given that CVE-2023-44221 allows for OS command injection on affected devices, organizations should prioritize updating to the latest firmware,” said a security researcher familiar with the vulnerability. SonicWall has issued an urgent warning to customers that threat actors are actively exploiting a high-severity command injection vulnerability in its Secure Mobile Access (SMA) appliances. This development comes shortly after SonicWall flagged another high-severity vulnerability (CVE-2021-20035) as being actively exploited, highlighting the continued targeting of VPN appliances by threat actors. The vulnerability impacts multiple SonicWall products, including SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v devices running firmware versions 10.2.1.9-57sv and earlier. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. SonicWall has released patches to address the vulnerability and strongly advises customers to upgrade to firmware version 10.2.1.14-75sv or later.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 01 May 2025 05:20:17 +0000