CVE-2024-22395

published 2024-02-24

CVE-2024-22395: Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a…

Priority P3 34 medium 6.3 CVSS 3.1

AV N AC L PR L UI N S U C L I L A L

Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a remote authenticated attacker to associate another user's MFA mobile application.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
sonicwall	sma100	—	—
sonicwall	sma_200_firmware	< 10.2.1.11-65sv	10.2.1.11-65sv
sonicwall	sma_210_firmware	< 10.2.1.11-65sv	10.2.1.11-65sv
sonicwall	sma_400_firmware	< 10.2.1.11-65sv	10.2.1.11-65sv
sonicwall	sma_410_firmware	< 10.2.1.11-65sv	10.2.1.11-65sv
sonicwall	sma_500v_firmware	< 10.2.1.11-65sv	10.2.1.11-65sv

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287