SonicWall SMA 100 RCE via chained management interface flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Two SonicWall SMA 100 vulnerabilities actively exploited in the wild enable remote code execution when chained together.
SonicWall Secure Mobile Access (SMA) 100 series management interfaces contain multiple vulnerabilities affecting SMA 200, 210, 400, 410, and 500v appliances. CVE-2023-44221 allows OS command injection via improper neutralization of special elements in the SSL-VPN management interface, enabling a remote authenticated attacker with administrative privileges to execute arbitrary commands as the 'nobody' user. CVE-2024-38475 involves improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier, allowing attackers to map URLs to unintended file system locations. When exploited in combination, these vulnerabilities can lead to remote code execution, session hijacking, and full system compromise.
WatchTowr and CISA confirm both vulnerabilities are actively being exploited in real-world attacks. Organizations using affected SMA models should immediately apply vendor patches after appropriate testing. Detection and mitigation strategies include vulnerability scanning, network segmentation to isolate VPN infrastructure, enforcement of least privilege, and regular penetration testing to identify exploitation chains.
Mentioned in this report
Detection guidance
Command Injection Metacharacters and Shell Commands in CGI Request to VPN Management Interface
Web request to a /cgi-bin/ endpoint whose query string combines shell metacharacters with command-execution keywords, matching OS command injection against SMA-style management interfaces (CVE-2023-44221). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Command Injection Metacharacters and Shell Commands in CGI Request to VPN Management
Interface
description: Detects HTTP requests to /cgi-bin/ endpoints where the query string combines
shell metacharacters (separators, pipes, backticks, command substitution) with command-execution
keywords. This pattern is consistent with OS command injection against SSL-VPN management
interfaces such as SonicWall SMA 100 (CVE-2023-44221). Generalises on the injection
pattern, not on a specific endpoint or payload.
status: experimental
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_uri:
cs-uri-stem|contains: /cgi-bin/
selection_meta:
cs-uri-query|contains:
- '%3B'
- '%7C'
- '%60'
- '%24%28'
- $(
- '`'
- '||'
- ;
selection_cmd:
cs-uri-query|contains:
- curl
- wget
- /bin/sh
- /bin/bash
- 'nc '
- chmod
- base64
- /dev/tcp/
condition: selection_uri and selection_meta and selection_cmd
falsepositives:
- Vulnerability scanners or authorised penetration tests against the management interface
- Legitimate CGI parameters that carry URLs or script text containing curl or wget
strings
level: medium
id: 1d2e85c6-f056-5047-a4f0-4a021fd4219b
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-secure-mobile-access-sma-100-series-management-interface-could-allow-for-remote-code-execution_2025-046
Web Server Process Spawning Shell with Download or Reverse Shell Commands on Linux Appliance
Apache/httpd parent spawning a shell whose command line downloads payloads or opens a reverse shell, indicating post-exploitation RCE via a public-facing web service. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell with Download or Reverse Shell Commands on
Linux Appliance
description: Detects a web server process (httpd/apache2) spawning a shell that runs
download, permission-change or reverse-shell commands. This is the typical result
of successful command injection or RCE chains against VPN appliance web interfaces
(for example SonicWall SMA 100, CVE-2023-44221 combined with CVE-2024-38475).
status: experimental
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /httpd
- /apache2
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- curl
- wget
- /dev/tcp/
- 'nc '
- chmod +x
- base64 -d
- mkfifo
condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Web applications with legitimate CGI scripts that shell out to curl or wget for
health checks
- Administrative troubleshooting scripts invoked through the web interface
level: high
id: 282e4b49-66ef-5c78-8b7c-634ad405ff7c
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-secure-mobile-access-sma-100-series-management-interface-could-allow-for-remote-code-execution_2025-046
Behavioural rules are generated from public reporting — validate in your environment before deploying.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs