SonicWall SMA100 arbitrary file deletion flaw

SonicWall SMA100 series appliances contain a critical vulnerability (CVSSv3.0: 9.1) allowing remote attackers to delete arbitrary files and gain administrator privileges.

Japan's IPA has issued a security alert regarding a critical vulnerability affecting SonicWall's SMA100 series remote access appliances. The vulnerability allows remote unauthenticated attackers to delete arbitrary files on the device, which can lead to complete compromise and administrative privilege escalation. SonicWall has characterized this as a high-impact vulnerability and urges immediate patching. The vendor has released security patches for supported versions but will not be providing fixes for end-of-life product lines. Organizations using affected devices should prioritize applying the available patches as soon as possible to mitigate the risk of exploitation.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/alert20211001.html