SONICWALL SMA 100 SERIES VULNERABILITY COULD ALLOW FOR SQL INJECTION

An update to the SonicWall SMA 100 Series alert was issued today, Feb. 4, 2021. The vulnerability could allow an attacker to execute remote code, which could potentially lead to a breach.

What It Is:

A vulnerability has been discovered in the SonicWall SMA 100 Series, which could allow for SQL injection. The SonicWall SMA 100 Series is a unified secure access gateway that enables organizations to provide access to any application, anytime, from anywhere and any devices, including managed and unmanaged.

Successful exploitation of this vulnerability could result in SQL injection, which enables the retrieval of admin credentials. Afterwards, this retrieval can pivot into a remote-code execution attack. Depending on the privileges associated with the application, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights.

Read the original SonicWall Security Advisories below for more information:

• Confirmed Zero-Day Vulnerability in The SonicWall SMA100 Build Version 10.X
• Urgent Patch Available For SMA 100 Series 10.X Firmware Zero-Day Vulnerability

Threat Intelligence:

There are currently reports of this vulnerability being exploited in the wild as per NCCGroup.

Systems Affected:

• SonicWall SMA 200, SMA 210, SMA 400, SMA 410
• SonicWall SMA 500v (Azure, AWS, ESXi, HyperV)

Risk:

Government:

• Large and medium government entities: High
• Small government entities: High

Businesses:

• Large and medium business entities: High
• Small business entities: High

Home users: Low

What It Means:

If you and/or your business utilize the SonicWall SMA 100 Series products mentioned above, you will need to apply the patched version of the SMA 10.x firmware to vulnerable systems immediately following proper testing.

Technical Summary:

A vulnerability has been discovered in the SonicWall SMA 100 Series, which could allow for SQL injection. The improper SQL command neutralization in the SonicWall SSLVPN SMA100 product enables the execution of SQL commands of the attacker’s choosing.

What To Do:

We recommend the following actions be taken:

• Apply the patched version of the SMA 10.x firmware to vulnerable systems immediately after appropriate testing.
• Apply appropriate countermeasures recommended by SonicWall within their advisory.
• Apply the Principle of Least Privilege to all systems and services.

Negative Consequences of Lost or Stolen Data:

The loss or theft of proprietary data can have severe impacts, particularly if the compromise becomes public and sensitive information is exposed. Possible impacts include:

• Temporary or permanent loss of sensitive or proprietary information.
• Disruption to regular operations.
• Financial losses incurred to restore systems and files.
• Potential harm to an organization’s reputation.

Should your agency or business need assistance with issues arising from vulnerabilities in SonicWall products including updates and/or patches, Dox can help. Please contact Dox if there is anything we can do to assist in securing your agency, business, or organization.

Thank you for your time and stay safe online.