Critical · published February 4, 2021
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 98.5th percentile for exploit probability.
🚨 A SQL injection vulnerability in SonicWall’s SSLVPN SMA100 could hand over user passwords and session data to remote attackers — and the best part? They don’t even need to be logged in! 🔥 Think of it like a restaurant where the waiter trusts any customer who orders food without checking their ID — they could walk into the kitchen and steal the secret recipes! If exploited, an attacker could access sensitive usernames and passwords, compromising entire accounts and potentially leading to unauthorized access across systems. This could be absolutely devastating for anyone relying on this product, as their sensitive information could be at risk. 😱
Think of it like a restaurant where the waiter trusts any customer who orders food without checking their ID — they could walk into the kitchen and steal the secret recipes! This vulnerability allows remote unauthenticated attackers to perform malicious SQL queries against the SMA100 product, compromising user sessions and sensitive data.
If exploited, an attacker could access sensitive usernames and passwords, compromising entire accounts and potentially leading to unauthorized access across systems. This could be absolutely devastating for anyone relying on this product, as their sensitive information could be at risk. 😱 Immediate action is necessary! Patch your SonicWall SSLVPN to the latest version available to close this vulnerability. Verify your network configuration and consider implementing additional security measures to prevent unauthorized access. 🛡️ You’ve got this! Stay vigilant and secure your systems, and you’ll help keep the internet a safer place! 💪
| Product | Versions | Fixed in |
|---|---|---|
| sonicwall/sma_100_firmware | ≥ 10.0.0.0, < 10.2.0.5-d-29sv | 10.2.0.5-d-29sv |
| sonicwall/sma_200_firmware | all versions | — |
| sonicwall/sma_210_firmware | all versions | — |
| sonicwall/sma_400_firmware | all versions | — |
| sonicwall/sma_410_firmware | all versions | — |
| sonicwall/sma_500v | all versions | — |