CVE-2025-32821 — OS Command Injection in Sma100

CWE-78 — OS Command Injection5 documents5 sources
Severity
7.2HIGHNVD
EPSS
0.6%
top 31.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Sonicwall SMA 100 FirmwareSonicwall SMA 200 FirmwareSonicwall SMA 210 Firmware+4 more
Timeline
PublishedMay 7
Latest updateOct 6

Description

A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell command arguments to upload a file on the appliance.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages7 packages

▶NVDsonicwall/sma_100_firmware< 10.2.1.15-81sv
▶CVEListV5sonicwall/sma10010.2.1.14-75sv and earlier versions
▶NVDsonicwall/sma_200_firmware< 10.2.1.15-81sv
▶NVDsonicwall/sma_210_firmware< 10.2.1.15-81sv
▶NVDsonicwall/sma_400_firmware< 10.2.1.15-81sv

🔴Vulnerability Details

2
CVEList
CVE-2025-32821: A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell command argum↗2025-05-07
▶
GHSA
GHSA-xv34-vpcm-23p2: A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell command argum↗2025-05-07
▶

🔍Detection Rules

1
Suricata
ET WEB_SPECIFIC_APPS SonicWall SMA Authenticated Command Injection (CVE-2025-32821)↗2025-10-06
▶

🕵️Threat Intelligence

1
Bleepingcomputer
SonicWall urges admins to patch VPN flaw exploited in attacks↗2025-05-08
▶
CVE-2025-32821 — OS Command Injection in Sma100 | cvebase