Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
CISA KEV·Added 2025-05-01 — agencies required to remediate by 2025-05-22

CVE-2023-44221

HIGH

Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands…

Published
Dec 5, 2023
Updated
Oct 31, 2025
Affected
0 pkgs
Patched
None yet
Exploits
None indexed

EPSS Exploitation Probability

via FIRST.org ↗
23.1%probability of exploitation in next 30 days
Moderate Risk96th percentile+0.49%
12.9%17.0%21.2%25.4%15.7%23.1%Dec 25Apr 26Jun 26

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Description

Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.

Affected Products

5 products · 5 configurations
OS
sma 200 firmwaresonicwall
≤ 10.2.1.9-57sv
range
OS
sma 210 firmwaresonicwall
≤ 10.2.1.9-57sv
range
OS
sma 400 firmwaresonicwall
≤ 10.2.1.9-57sv
range
OS
sma 410 firmwaresonicwall
≤ 10.2.1.9-57sv
range
OS
sma 500v firmwaresonicwall
≤ 10.2.1.9-57sv
range

Frequently Asked Questions

Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
O3 Security · Impact-Aware SCA

Is CVE-2023-44221 in your stack?

O3 detects CVE-2023-44221 across dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.