Sma 400 Firmware vulnerabilities
14 known vulnerabilities in Sma 400 Firmware from SonicWall. 13 are rated high or critical, and 5 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
SMA100: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell command arguments to upload a file on the appliance.
- 8.8 High severity
SMA100: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make any directory on the SMA appliance writable.
- 8.8 High severity
SMA100: Files or Directories Accessible to External Parties
A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.
- 8.1 High severity
SMA100: Stack-based Buffer Overflow
A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web server allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.
- 8.1 High severity
SMA100: Stack-based Buffer Overflow
A vulnerability in the SonicWall SMA100 SSLVPN web management interface allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.
- 7.5 High severity
SMA100: Heap-based Buffer Overflow
Heap-based buffer overflow vulnerability in the SonicWall SMA100 SSLVPN due to the use of strcpy. This allows remote authenticated attackers to cause Heap-based buffer overflow and potentially lead to code execution.
- 9.1 Critical severity
Apache HTTP Server Improper Escaping of Output Exploited
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code
- 8.8 High severity
SMA100: Improper Authentication
Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using accent characters, resulting in an MFA bypass.
- 7.2 High severity
SonicWall SMA100 Appliances OS Command Injection Exploited
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerabili
- 8.8 High severity
SMA100: Out-of-bounds Write
A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to cause Denial of Service (DoS) on the appliance or potentially lead to code execution. This vulnerability impacts 10.2.1.5-34sv and earlier ve
- 9.8 Critical severity
SonicWall SRA/SMA100: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products, specifically the SRA appliances r
- 9.8 Critical severity
SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Exploited
A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210,
- 6.5 Medium severity
SonicWall SMA100 Appliances OS Command Injection Exploited
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.
- 9.8 Critical severity
SonicWall SSLVPN SMA100 SQL Injection Exploited
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.