CVE-2023-44221

Assessment

Why it matters

CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 74.9%; technical severity is CVSS 7.2.

Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.

Who should care

• Teams operating Sma 200 Firmware, Sma 210 Firmware, Sma 400 Firmware +3 more
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether Sma 200 Firmware, Sma 210 Firmware, Sma 400 Firmware +3 more is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. SonicWall Security advisory SNWLID 2023 0018
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-78

Affected versions

SonicWall Sma 200 Firmware (End Including 10.2.1.9-57sv); SonicWall Sma 210 Firmware (End Including 10.2.1.9-57sv); SonicWall Sma 400 Firmware (End Including 10.2.1.9-57sv); SonicWall Sma 410 Firmware (End Including 10.2.1.9-57sv); SonicWall Sma 500v Firmware (End Including 10.2.1.9-57sv); SonicWall SMA100 Appliances

Fixed versions

No explicit fixed version is currently recorded.

Published

5 December 2023

Attack vector

Network

Privileges required

High

User interaction

None

Signal timeline

1. 5 Dec 2023CVE published
2. 30 Apr 2025Added to CISA KEV
3. 21 Aug 2026Latest EPSS score: 74.9%
4. 19 Aug 2026 · 12:58 UTCSignal calculated at 80

External references

• CISA Government advisory CVE-2023-44221 ↗