Vulnerabilities > Sonicwall > SMA 500V Firmware > 9.0.0.9.26sv

DATE CVE VULNERABILITY TITLE RISK
2023-12-05 CVE-2023-44221 OS Command Injection vulnerability in Sonicwall products
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
network
low complexity
sonicwall CWE-78
7.2
2023-12-05 CVE-2023-5970 Improper Authentication vulnerability in Sonicwall products
Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using accent characters, resulting in an MFA bypass.
network
low complexity
sonicwall CWE-287
8.8
2022-06-08 CVE-2022-1703 OS Command Injection vulnerability in Sonicwall products
Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Commands which potentially leads to remote command execution vulnerability or denial of service (DoS) attack.
network
low complexity
sonicwall CWE-78
critical
9.0
2022-04-13 CVE-2022-22279 Path Traversal vulnerability in Sonicwall products
A post-authentication arbitrary file read vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier versions and Secure Mobile Access (SMA) 100 series products running older firmware 9.0.0.9-26sv and earlier versions
network
low complexity
sonicwall CWE-22
4.9
2022-03-17 CVE-2022-22273 OS Command Injection vulnerability in Sonicwall products
Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier versions and Secure Mobile Access (SMA) 100 series products running older firmware 9.0.0.9-26sv and earlier versions
network
low complexity
sonicwall CWE-78
critical
9.8
2021-12-23 CVE-2021-20049 Information Exposure Through Discrepancy vulnerability in Sonicwall products
A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses.
network
low complexity
sonicwall CWE-203
5.0
2021-12-23 CVE-2021-20050 Unspecified vulnerability in Sonicwall products
An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data.
network
low complexity
sonicwall
7.5
2021-08-04 CVE-2021-20028 SQL Injection vulnerability in Sonicwall products
Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier
network
low complexity
sonicwall CWE-89
critical
9.8