Vulnerabilities > Sonicwall > SMA 210 Firmware > 10.2.1.2.24sv

DATE CVE VULNERABILITY TITLE RISK
2023-12-05 CVE-2023-44221 OS Command Injection vulnerability in Sonicwall products
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
network
low complexity
sonicwall CWE-78
7.2
2023-12-05 CVE-2023-5970 Improper Authentication vulnerability in Sonicwall products
Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using accent characters, resulting in an MFA bypass.
network
low complexity
sonicwall CWE-287
8.8
2022-06-08 CVE-2022-1703 OS Command Injection vulnerability in Sonicwall products
Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Commands which potentially leads to remote command execution vulnerability or denial of service (DoS) attack.
network
low complexity
sonicwall CWE-78
critical
9.0
2021-12-23 CVE-2021-20049 Information Exposure Through Discrepancy vulnerability in Sonicwall products
A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses.
network
low complexity
sonicwall CWE-203
5.0
2021-12-23 CVE-2021-20050 Unspecified vulnerability in Sonicwall products
An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data.
network
low complexity
sonicwall
7.5
2021-12-08 CVE-2021-20038 Out-of-bounds Write vulnerability in Sonicwall products
A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance.
network
low complexity
sonicwall CWE-787
7.5