SonicWall SMA 100 Series RCE actively exploited
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Remote code execution flaw in SonicWall SMA 100 management interface is actively exploited; patch immediately.
A command injection vulnerability in the SonicWall Secure Mobile Access (SMA) 100 Series management interface allows remote authenticated attackers to execute arbitrary code as the 'nobody' user. SonicWall confirmed on April 15, 2025 that this vulnerability is being actively exploited in the wild. The affected models include SMA 200, 210, 400, 410, and 500v (across ESX, KVM, AWS, and Azure deployments) running versions 10.2.1.0-17sv and earlier, 10.2.0.7-34sv and earlier, and 9.0.0.10-28sv and earlier. The CVSS score was upgraded from medium to high (7.2) due to active exploitation.
Defenders should prioritize patching affected SMA appliances immediately after testing, implement network segmentation to isolate critical access gateways, enforce the principle of least privilege to limit damage from compromised 'nobody' user context, and conduct vulnerability scanning to identify exposed instances. Organizations relying on SMA for remote access should treat this as urgent given active exploitation.
Mentioned in this report
Detection guidance
Web Server Process Spawning Shell With Download or Reverse-Shell Commands (Linux)
Detects a web server process (httpd, apache2, nginx, lighttpd) spawning a shell that runs download, reverse-shell or encoding commands, the typical result of command injection in an appliance web interface such as SMA 100. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell With Download or Reverse-Shell Commands (Linux)
description: Detects a web server process (httpd, apache2, nginx, lighttpd) spawning
a shell that runs download, reverse-shell or encoding commands. This is the typical
post-exploitation outcome of command injection in a management interface such as
SonicWall SMA 100, where code runs as the 'nobody' user.
tags:
- attack.execution
- attack.t1059
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /lighttpd
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- wget
- curl
- /dev/tcp/
- mkfifo
- 'nc '
- base64 -d
- chmod +x
condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Web applications or CGI health-check scripts that legitimately call curl or wget
through a shell
- Administrative CGI tooling on appliances that fetches updates via curl
level: high
id: 8dc4e2ac-2e0a-54c2-ad9d-df6c93896eec
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-sonicwall-secure-mobile-access-sma-100-series-management-interface-could-allow-for-remote-code-execution_2025-043
Command Injection Metacharacters With Shell Commands in Web Request Query
Detects web requests whose query string chains shell commands (curl, wget, sh, /dev/tcp) via separators, pipes or command substitution, indicating command-injection attempts against public-facing management interfaces. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Command Injection Metacharacters With Shell Commands in Web Request Query
description: Detects web requests whose query string chains shell commands (curl,
wget, /bin/sh, /dev/tcp) using separators, pipes or command substitution. Indicates
command-injection attempts against public-facing management interfaces such as SonicWall
SMA 100. Does not rely on a specific endpoint or payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- ;wget
- ;curl
- '|wget'
- '|curl'
- '%3bwget'
- '%3bcurl'
- '%7ccurl'
- '%7cwget'
- $(curl
- $(wget
- /dev/tcp/
- ;/bin/sh
- ;/bin/bash
- '%3b/bin/sh'
- '%3b/bin/bash'
condition: selection
falsepositives:
- Security scanners or penetration tests run against the appliance
- Applications that pass shell-like text in query parameters, such as documentation
or code-sharing sites
level: medium
id: d9ef7c05-1771-5dff-bc56-7c7278ca7088
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-sonicwall-secure-mobile-access-sma-100-series-management-interface-could-allow-for-remote-code-execution_2025-043
Behavioural rules are generated from public reporting — validate in your environment before deploying.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs