7.2

CVE-2025-32821

Medienbericht

A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell command arguments to upload a file on the appliance.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sonicwall ≫ Sma 100 Firmware Version < 10.2.1.15-81sv
   Sonicwall ≫ Sma 100 Version-
Sonicwall ≫ Sma 200 Firmware Version < 10.2.1.15-81sv
   Sonicwall ≫ Sma 200 Version-
Sonicwall ≫ Sma 210 Firmware Version < 10.2.1.15-81sv
   Sonicwall ≫ Sma 210 Version-
Sonicwall ≫ Sma 400 Firmware Version < 10.2.1.15-81sv
   Sonicwall ≫ Sma 400 Version-
Sonicwall ≫ Sma 410 Firmware Version < 10.2.1.15-81sv
   Sonicwall ≫ Sma 410 Version-
Sonicwall ≫ Sma 500v Firmware Version < 10.2.1.15-81sv
   Sonicwall ≫ Sma 500v Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.424
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.1 1.6 5.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.