Article Details

SonicWall Patches 3 Flaws in SMA 100 Devices Allowing Attackers to Run Code as Root. SonicWall has released patches to address three security flaws affecting SMA 100 Secure Mobile Access (SMA) appliances that could be fashioned to result in remote code execution. The vulnerabilities are listed below - "An attacker with access to an SMA SSL-VPN user account can chain these vulnerabilities to make a sensitive system directory writable, elevate their privileges to SMA administrator, and write an executable file to a system directory," Rapid7 said in a report. "This chain results in root-level remote code execution." CVE-2025-32819 is assessed to be a patch bypass for a previously identified flaw reported by NCC Group in December 2021. The cybersecurity company noted that CVE-2025-32819 may have been exploited in the wild as a zero-day based on known indicators of compromise (IoCs) and incident response investigations. However, it's worth noting that SonicWall makes no mention of the flaw being weaponized in real-world attacks. The shortcomings, that impact SMA 100 Series including SMA 200, 210, 400, 410, 500v, have been addressed in version 10.2.1.15-81sv. The development comes as multiple security flaws in SMA 100 Series devices have come under active exploitation in recent weeks, including CVE-2021-20035, CVE-2023-44221, and CVE-2024-38475. Users are advised to update their instances to the latest version for optimal protection.