Article Details
Scrape Timestamp (UTC): 2025-04-17 05:49:32.477
Source: https://thehackernews.com/2025/04/cisa-flags-actively-exploited.html
Original Article Text
Click to Toggle View
CISA Flags Actively Exploited Vulnerability in SonicWall SMA Devices. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting SonicWall Secure Mobile Access (SMA) 100 Series gateways to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The high-severity vulnerability, tracked as CVE-2021-20035 (CVSS score: 7.2), relates to a case of operating system command injection that could result in code execution. "Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution," SonicWall said in an advisory released in September 2021. The flaw impacts SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v (ESX, KVM, AWS, Azure) devices running the following versions - While the exact details surrounding the exploitation of CVE-2021-20035 are presently unknown, SonicWall has since revised the bulletin to acknowledge that "this vulnerability is potentially being exploited in the wild." Federal Civilian Executive Branch (FCEB) agencies are required to apply the necessary mitigations by May 7, 2025, to secure their networks against active threats.
Daily Brief Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical security flaw in SonicWall SMA 100 Series to its KEV catalog due to active exploits.
The vulnerability, known as CVE-2021-20035 with a CVSS score of 7.2, involves an operating system command injection that can lead to unauthorized code execution.
Affected devices include SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v across various platforms such as ESX, KVM, AWS, and Azure.
SonicWall issued an advisory in September 2021, describing the vulnerability as allowing remote authenticated attacks through improper neutralization in the SMA100 management interface.
The flaw permits attackers to execute arbitrary commands as a 'nobody' user, escalating the potential for targeted code execution attacks.
Details on the exact nature of the active exploitations remain undisclosed, but the threat is considered significant enough to warrant a required update by Federal Civilian Executive Branch agencies by May 7, 2025.