[ad_1]
Community safety vendor SonicWall is urging clients to replace their SMA 100 collection home equipment to the newest model following the invention of a number of safety vulnerabilities that might be abused by a distant attacker to take full management of an affected system.
The issues affect SMA 200, 210, 400, 410, and 500v merchandise working variations 9.0.0.11-31sv and earlier, 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier. The San Jose-based firm credited safety researchers Jake Baines (Rapid7) and Richard Warren (NCC Group) for locating and reporting the shortcomings.
The record of eight safety vulnerabilities recognized in its distant entry merchandise is as follows –
- CVE-2021-20038 (CVSS rating: 9.8) – SMA100 Collection unauthenticated stack-based buffer overflow vulnerability
- CVE-2021-20039 (CVSS rating: 7.2) – SMA 100 Collection authenticated command injection vulnerability as root
- CVE-2021-20040 (CVSS rating: 6.5) – SMA 100 Collection unauthenticated file add path traversal vulnerability
- CVE-2021-20041 (CVSS rating: 7.5) – SMA 100 Collection unauthenticated CPU exhaustion vulnerability
- CVE-2021-20042 (CVSS rating: 6.3) – SMA 100 Collection unauthenticated “Confused Deputy” vulnerability
- CVE-2021-20043 (CVSS rating: 8.8) – SMA 100 Collection “getBookmarks” heap-based buffer overflow vulnerability
- CVE-2021-20044 (CVSS rating: 7.2) – SMA 100 Collection post-authentication distant code execution (RCE) vulnerability
- CVE-2021-20045 (CVSS rating: 9.4) – SMA 100 Collection unauthenticated file explorer heap-based and stack-based buffer overflow vulnerabilities
Profitable exploitation of the failings might permit an adversary to execute arbitrary code, add specifically crafted payloads, modify or delete recordsdata situated in particular directories, reboot system remotely, bypass firewall guidelines, and even eat all the machine’s CPU, doubtlessly inflicting a denial-of-service (DoS) situation.
Whereas there isn’t a proof that these vulnerabilities are being exploited within the wild, it is extremely beneficial that customers transfer shortly to use the patches in mild of the truth that SonicWall gadgets have grow to be a profitable goal for menace actors to launch a slew of malicious actions in latest months.
[ad_2]
