High Severity OS Command Injection (CVE‑2023‑44221) in SonicWall SMA100 SSL‑VPN Appliances
What It Is – SonicWall SMA100 appliances expose an OS command‑injection flaw in the SSL‑VPN management interface. An attacker who authenticates with administrative credentials can inject arbitrary OS commands that run under the low‑privilege “nobody” account.
Exploitability – The vulnerability is remote‑authenticated; proof‑of‑concept code is publicly available. The CVSS base score is 7.8 (High).
Affected Products – SonicWall SMA100 series (all firmware versions prior to the vendor’s security advisory).
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous verification of privileged‑access controls and segregation of duties.
- Demonstrates why audit‑ready logging of command‑execution events is essential for detecting abuse.
- Provides a concrete example of a control gap that maps to multiple frameworks (e.g., NIST CSF Identify and Protect functions).
Recommended Actions
- Apply SonicWall’s latest firmware patch that removes the injection vector.
- Enforce least‑privilege for VPN administrators and rotate admin credentials regularly.
- Enable detailed command‑execution logging on the appliance and integrate logs with a SIEM for real‑time monitoring.
- Conduct a control‑mapping review to confirm that access‑control and logging objectives are evidentially met.
Source: CISA KEV – CVE‑2023‑44221