S4
Product
Sma 410 Firmware
On CISA KEVExploited in the wildRansomware-linked
35
CVEs
6
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 9High 19Medium 7Low 0
Watch
Add Sma 410 Firmware to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-44221 In wildKEV | 7.2 | Dec 5 | SonicWall SMA100 Appliances OS Command Injection Vulnerability Affected: through 10.2.1.9-57sv |
| CVE-2025-32820 | 8.8 | May 7 | A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make any directory on the SMA appliance… Affected: before 10.2.1.15-81sv |
| CVE-2025-32819 | 8.8 | May 7 | A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file potentially resulting… Affected: before 10.2.1.15-81sv |
| CVE-2023-5970 | 8.8 | Dec 5 | Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using accent characters,… Affected: through 10.2.1.9-57sv |
| CVE-2022-2915 | 8.8 | Aug 26 | A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to cause Denial of Service (DoS) on the appliance or… Affected: through 10.2.1.5-34sv |
| CVE-2022-1703 | 8.8 | Jun 8 | Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Commands which… Affected: through 10.2.1.4-31sv; through 10.2.0.9-41sv |
| CVE-2021-20044 | 8.8 | Dec 8 | A post-authentication remote command injection vulnerability in SonicWall SMA100 allows a remote authenticated attacker to execute OS system commands in the appliance Affected: 10.2.0.8-37sv; 10.2.1.1-19sv |
| CVE-2021-20043 | 8.8 | Dec 8 | A Heap-based buffer overflow vulnerability in SonicWall SMA100 getBookmarks method allows a remote authenticated attacker to potentially execute code as the nobody user in the… Affected: 10.2.0.8-37sv; 10.2.1.1-19sv |
| CVE-2021-20039 | 8.8 | Dec 8 | Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary… Affected: 9.0.0.11-31sv; 10.2.0.8-37sv; 10.2.1.1-19sv |
| CVE-2024-53703 | 8.1 | Dec 5 | A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web server allows remote attackers to cause… Affected: before 10.2.1.14-75sv |
| CVE-2024-45318 | 8.1 | Dec 5 | A vulnerability in the SonicWall SMA100 SSLVPN web management interface allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution Affected: before 10.2.1.14-75sv |
| CVE-2025-40597 | 7.5 | Jul 23 | A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in… Affected: before 10.2.2.1-90sv |
| CVE-2024-40763 | 7.5 | Dec 5 | Heap-based buffer overflow vulnerability in the SonicWall SMA100 SSLVPN due to the use of strcpy Affected: before 10.2.1.14-75sv |
| CVE-2021-20050 | 7.5 | Dec 23 | An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing… Affected: before 10.0.0.0; 10.2.0.8-37sv; 10.2.1.2-24sv |
| CVE-2021-20049 | 7.5 | Dec 23 | A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses Affected: before 10.0.0.0; 10.2.0.8-37sv; 10.2.1.2-24sv |
| CVE-2021-20041 | 7.5 | Dec 8 | An unauthenticated and remote adversary can consume all of the device's CPU due to crafted HTTP requests sent to SMA100 /fileshare/sonicfiles/sonicfiles resulting in a loop with… Affected: 9.0.0.11-31sv; 10.2.0.8-37sv; 10.2.1.1-19sv |
| CVE-2021-20040 | 7.5 | Dec 8 | A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages or files as a 'nobody' user Affected: 10.2.0.8-37sv; 10.2.1.1-19sv |
| CVE-2025-40596 | 7.3 | Jul 23 | A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in… Affected: before 10.2.2.1-90sv |
| CVE-2025-32821 | 7.2 | May 7 | A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell command arguments to upload a file on the… Affected: before 10.2.1.15-81sv |
Showing 19