PT-2023-3805 · Sonicwall · Sonicwall Analytics+1

Published

2023-07-12

·

Updated

2024-11-02

·

CVE-2023-34127

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions SonicWall GMS versions 9.3.2-SP1 and earlier SonicWall Analytics versions 2.5.0.4-R7 and earlier
Description The issue exists due to improper neutralization of special elements used in an OS command, allowing an authenticated attacker to execute arbitrary code with root privileges. This is described as an "OS Command Injection" vulnerability. Active exploitation has been detected.
Recommendations For SonicWall GMS versions 9.3.2-SP1 and earlier, update to a version later than 9.3.2-SP1 to resolve the issue. For SonicWall Analytics versions 2.5.0.4-R7 and earlier, update to a version later than 2.5.0.4-R7 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable OS Command functionality until a patch is available.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-04097
CVE-2023-34127

Affected Products

Sonicwall Analytics
Sonicwall Gms