Conversation

Today, @fuzz disclosed 3 new vulnerabilities in SonicWall SMA-100 series appliances, one of which we believe may have been used in the wild. We're grateful to SonicWall's PSIRT team for a smooth and exceptionally quick response!

An attacker with access to an SMA SSLVPN user account can chain these 3 vulnerabilities to make a sensitive system directory writable, elevate their privileges to SMA administrator, and write an executable file to a system directory. This chain results in root-level remote code execution. The vulnerabilities have been fixed in the latest version.

https://www.rapid7.com/blog/post/2025/05/07/multiple-vulnerabilities-in-sonicwall-sma-100-series-2025/