SonicWall Patches 3 Flaws in SMA 100 Devices Allowing Attackers to Run Code as Root

SonicWall has released patches to address three security flaws affecting SMA 100 Secure Mobile Access (SMA) appliances that could be fashioned to result in remote code execution.

The vulnerabilities are listed below –

• CVE-2025-32819 (CVSS score: 8.8) – A vulnerability in SMA100 allows a remote authenticated attacker with SSL-VPN user privileges to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.
• CVE-2025-32820 (CVSS score: 8.3) – A vulnerability in SMA100 allows a remote authenticated attacker with SSL-VPN user privileges can inject a path traversal sequence to make any directory on the SMA appliance writable
• CVE-2025-32821 (CVSS score: 6.7) – A vulnerability in SMA100 allows a remote authenticated attacker with SSL-VPN admin privileges can with admin privileges can inject shell command arguments to upload a file on the appliance

“An attacker with access to an SMA SSL-VPN user account can chain these vulnerabilities to make a sensitive system directory writable, elevate their privileges to SMA administrator, and write an executable file to a system directory,” Rapid7 said in a report. “This chain results in root-level remote code execution.”

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

CVE-2025-32819 is assessed to be a patch bypass for a previously identified flaw reported by NCC Group in December 2021.

The cybersecurity company noted that CVE-2025-32819 may have been exploited in the wild as a zero-day based on known indicators of compromise (IoCs) and incident response investigations. However, it’s worth noting that SonicWall makes no mention of the flaw being weaponized in real-world attacks.

The shortcomings, that impact SMA 100 Series including SMA 200, 210, 400, 410, 500v, have been addressed in version 10.2.1.15-81sv.

The development comes as multiple security flaws in SMA 100 Series devices have come under active exploitation in recent weeks, including CVE-2021-20035, CVE-2023-44221, and CVE-2024-38475. Users are advised to update their instances to the latest version for optimal protection.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.