DaystoPatch

SonicWallExploited incident

SonicWall SMA 100 post-authentication OS command injection (2023 bug exploited in 2025)

CVE-2023-44221, CVE-2023-5970High, CVSS 7.2In CISA's Known Exploited Vulnerabilities catalog since 1 May 2025

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
0h
First public report to first vendor statement
Exposure
0h
First public report to first fix
Follow-through
0h
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    SonicWall PSIRT SNWLID-2023-0018 (PSIRT API record)CuratedQuote verified

    "published_when":"2023-12-04T15:17:50Z"

    Coordinated disclosure with a fix in 2023. SonicWall added an exploitation note on 2025-04-29 (revision 1.1).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b891513313f14771…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    SonicWall advisory SNWLID-2023-0018ClaimedQuote verified4 Dec 2023, 15:17 UTC

    2) CVE-2023-5970 - Post Authentication External User MFA Bypass Vulnerability

    The vendor's own disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2cb53cfffa38a52c…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2023-44221ClaimedQuote verified5 Dec 2023, 20:10 UTC

    Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody'

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:535a6571ff271dba…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet30 Apr 2025, 17:45 UTC

    SonicWall is sounding the alarm: their Secure Mobile Access appliances are under attack from vulnerabilities CVE-2023-44221 and CVE-2024-38475. It's like a cybersecurity horror movie where the villain is a command injection flaw and the sequel involves unauthorized URL mapping. Time

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2023-44221)ClaimedQuote verified1 May 2025

    SonicWall SMA100 Appliances OS Command Injection Vulnerability

    Added to CISA's KEV catalog on 2025-05-01.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet5 May 2025, 16:35 UTC

    SonicBoom, From Stolen Tokens to Remote Shells - SonicWall SMA (CVE-2023-44221, CVE-2024-38475) # CVE_2023_44221 # CVE_2024_38475 https:// labs.watchtowr.com/sonicboom-f rom-stolen-tokens-to-remote-shells-sonicwall-sma100-cve-2023-44221-c

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    SonicWall advisory SNWLID-2023-0018ClaimedQuote verified

    2) CVE-2023-5970 - Post Authentication External User MFA Bypass Vulnerability

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2cb53cfffa38a52c…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    SonicWall PSIRT SNWLID-2023-0018 (PSIRT API record)CuratedQuote verified4 Dec 2023, 15:17 UTC

    "published_when":"2023-12-04T15:17:50Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b891513313f14771…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    at disclosure

    SonicWall PSIRT SNWLID-2023-0018 (PSIRT API record)CuratedQuote verified

    10.2.1.10-62sv and higher versions.

    Fixed firmware listed in the advisory; the record's revision history shows only an exploitation comment added later (2025-04-29), not a fixed-version change. The 10.2.1.10-62sv release may predate the advisory (not verified). Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b891513313f14771…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    at disclosure

    SonicWall PSIRT SNWLID-2023-0018 (PSIRT API record)CuratedQuote verified

    10.2.1.10-62sv and higher versions.

    Single affected line (10.2.1.x).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b891513313f14771…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • SMA 100 Series (SMA 200, 210, 400, 410, 500v)
How we built this timeline

Advisory also covers CVE-2023-5970 (not in KEV). Revision history: v1.0 04-Dec-2023 initial release; v1.1 29-Apr-2025 'potentially being exploited in the wild'.

KEV 1 May 2025. Requires an authenticated administrator.

Fix predates exploitation, so exploited before a fix is false.

Related

SonicWall report card