CVE-2023-34126
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Vulnerability in SonicWall GMS and Analytics allows an authenticated attacker to upload files on the underlying filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
Risk Assessment
An attacker with the appropriate privileges could introduce malicious files, potentially leading to system compromise or data leakage.
Recommendation
It is recommended to update to the latest versions of GMS and Analytics to mitigate this vulnerability.
Other vulnerabilities in SonicWall GMS, SonicWall Analytics
See all- CVE-2023-34137Critical
The SonicWall GMS and Analytics CAS Web Services application uses static values for authentication without proper checks, leading to an authentication bypass vulnerability. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34136Critical
Vulnerability in SonicWall GMS and Analytics allows unauthenticated attacker to upload files to a restricted location not controlled by the attacker. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34130Critical
SonicWall GMS and Analytics use outdated Tiny Encryption Algorithm (TEA) with a hardcoded key to encrypt sensitive data. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34127High
CVE-2023-34127 describes an improper neutralization of special elements used in OS commands, allowing an authenticated attacker to execute arbitrary code with root privileges in SonicWall GMS and SonicWall Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34124Critical
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34123High
CVE-2023-34123 involves the use of a hard-coded cryptographic key in SonicWall GMS and SonicWall Analytics. This issue affects GMS versions: 9.3.2-SP1 and earlier; Analytics: 2.5.0.4-R7 and earlier.
Original NVD description (English source)
Vulnerability in SonicWall GMS and Analytics allows an authenticated attacker to upload files on the underlying filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.