# SonicWall SMA 100 RCE via chained management interface flaws

Published: 2026-06-09 · Severity: severe · Sectors: government-national, financial-services, technology, defense
Canonical: https://vorant.io/reports/2ceed3c0-bddb-50db-8433-9f963f8c8c06/sonicwall-sma-100-rce-via-chained-management-interface-flaws

> Two SonicWall SMA 100 vulnerabilities actively exploited in the wild enable remote code execution when chained together.

SonicWall Secure Mobile Access (SMA) 100 series management interfaces contain multiple vulnerabilities affecting SMA 200, 210, 400, 410, and 500v appliances. CVE-2023-44221 allows OS command injection via improper neutralization of special elements in the SSL-VPN management interface, enabling a remote authenticated attacker with administrative privileges to execute arbitrary commands as the 'nobody' user. CVE-2024-38475 involves improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier, allowing attackers to map URLs to unintended file system locations. When exploited in combination, these vulnerabilities can lead to remote code execution, session hijacking, and full system compromise.

WatchTowr and CISA confirm both vulnerabilities are actively being exploited in real-world attacks. Organizations using affected SMA models should immediately apply vendor patches after appropriate testing. Detection and mitigation strategies include vulnerability scanning, network segmentation to isolate VPN infrastructure, enforcement of least privilege, and regular penetration testing to identify exploitation chains.

## Mentioned in this report

- Vulnerabilities: CVE-2023-44221 (KEV), CVE-2024-38475 (KEV)

## Detection guidance (public sample)

### Command Injection Metacharacters and Shell Commands in CGI Request to VPN Management Interface

ATT&CK: T1190

Web request to a /cgi-bin/ endpoint whose query string combines shell metacharacters with command-execution keywords, matching OS command injection against SMA-style management interfaces (CVE-2023-44221). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Command Injection Metacharacters and Shell Commands in CGI Request to VPN Management
  Interface
description: Detects HTTP requests to /cgi-bin/ endpoints where the query string combines
  shell metacharacters (separators, pipes, backticks, command substitution) with command-execution
  keywords. This pattern is consistent with OS command injection against SSL-VPN management
  interfaces such as SonicWall SMA 100 (CVE-2023-44221). Generalises on the injection
  pattern, not on a specific endpoint or payload.
status: experimental
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains: /cgi-bin/
  selection_meta:
    cs-uri-query|contains:
    - '%3B'
    - '%7C'
    - '%60'
    - '%24%28'
    - $(
    - '`'
    - '||'
    - ;
  selection_cmd:
    cs-uri-query|contains:
    - curl
    - wget
    - /bin/sh
    - /bin/bash
    - 'nc '
    - chmod
    - base64
    - /dev/tcp/
  condition: selection_uri and selection_meta and selection_cmd
falsepositives:
- Vulnerability scanners or authorised penetration tests against the management interface
- Legitimate CGI parameters that carry URLs or script text containing curl or wget
  strings
level: medium
id: 1d2e85c6-f056-5047-a4f0-4a021fd4219b
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-secure-mobile-access-sma-100-series-management-interface-could-allow-for-remote-code-execution_2025-046
```

### Web Server Process Spawning Shell with Download or Reverse Shell Commands on Linux Appliance

ATT&CK: T1190

Apache/httpd parent spawning a shell whose command line downloads payloads or opens a reverse shell, indicating post-exploitation RCE via a public-facing web service. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Spawning Shell with Download or Reverse Shell Commands on
  Linux Appliance
description: Detects a web server process (httpd/apache2) spawning a shell that runs
  download, permission-change or reverse-shell commands. This is the typical result
  of successful command injection or RCE chains against VPN appliance web interfaces
  (for example SonicWall SMA 100, CVE-2023-44221 combined with CVE-2024-38475).
status: experimental
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /httpd
    - /apache2
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - /dev/tcp/
    - 'nc '
    - chmod +x
    - base64 -d
    - mkfifo
  condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Web applications with legitimate CGI scripts that shell out to curl or wget for
  health checks
- Administrative troubleshooting scripts invoked through the web interface
level: high
id: 282e4b49-66ef-5c78-8b7c-634ad405ff7c
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-secure-mobile-access-sma-100-series-management-interface-could-allow-for-remote-code-execution_2025-046
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-secure-mobile-access-sma-100-series-management-interface-could-allow-for-remote-code-execution_2025-046

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2ceed3c0-bddb-50db-8433-9f963f8c8c06/sonicwall-sma-100-rce-via-chained-management-interface-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup