SonicWall has introduced new software for its Secure Mobile Access (SMA) 100 series remote access appliances that resolves 8 vulnerabilities consisting of two critical and four high-severity vulnerabilities.
Threat actors are taking advantage of vulnerabilities in SonicWall appliances in past times in ransomware attacks. Though there are no identified incidents of exploiting the most current batch of vulnerabilities in the wild at the moment, there is a huge risk of these vulnerabilities being used in case the firmware is not updated on time. The SMA 100 series appliances affected by the vulnerabilities include the SonicWall SMA 210, 200, 410, 400, and 500v secure access gateway items.
The most critical vulnerabilities are buffer overflow problems which an unauthenticated attacker may take advantage of remotely to implement code on unsecured devices. These are
- CVE-2021-20045 has a CVSS score of 9.4. It covers a number of unauthenticated file explorer heap-dependent and stack-based buffer overflow issues.
- CVE-2021-20038 has a CVSS score of 9.8. It is an unauthenticated stack-based buffer overflow vulnerability
The 4 high severity vulnerabilities are the following:
- CVE-2021-20041 has a CVSS score of 7.5. It is an unauthenticated CPU exhaustion vulnerability.
- CVE-2021-20043 has a CVSS score of 8.8. It is a heap-dependent buffer overflow vulnerability that permits remote code execution. But an attacker should be authenticated.
- CVE-2021-20044 has a CVSS score of 7.2. It is a post-authentication remote code execution vulnerability.
- CVE-2021-20039 has a CVSS score of 7.2. It is an authenticated command injection vulnerability.
Two medium-severity vulnerabilities were likewise resolved:
- CVE-2021-20042 has a CVSS score of 6.3. It is an unauthenticated ‘confused deputy’ vulnerability.
- CVE-2021-20040 has a CVSS score of 6.5. It is an unauthenticated file upload path traversal vulnerability.
The software update is available at MySonicWall.com and ought to be used without delay to avert exploitation. SonicWall states no temporary mitigations could be applied to stop the exploitation of the vulnerabilities.