CVE-2023-34127
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
CVE-2023-34127 describes an improper neutralization of special elements used in OS commands, allowing an authenticated attacker to execute arbitrary code with root privileges in SonicWall GMS and SonicWall Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
Risk Assessment
An attacker with appropriate privileges can gain full control over the system, posing a serious threat to the security of the organization's data and infrastructure.
Recommendation
It is recommended to update to the latest versions of SonicWall GMS and Analytics to mitigate the risk associated with this vulnerability.
Other vulnerabilities in SonicWall GMS, SonicWall Analytics
See all- CVE-2023-34137Critical
The SonicWall GMS and Analytics CAS Web Services application uses static values for authentication without proper checks, leading to an authentication bypass vulnerability. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34136Critical
Vulnerability in SonicWall GMS and Analytics allows unauthenticated attacker to upload files to a restricted location not controlled by the attacker. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34130Critical
SonicWall GMS and Analytics use outdated Tiny Encryption Algorithm (TEA) with a hardcoded key to encrypt sensitive data. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34124Critical
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34126High
Vulnerability in SonicWall GMS and Analytics allows an authenticated attacker to upload files on the underlying filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34123High
CVE-2023-34123 involves the use of a hard-coded cryptographic key in SonicWall GMS and SonicWall Analytics. This issue affects GMS versions: 9.3.2-SP1 and earlier; Analytics: 2.5.0.4-R7 and earlier.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analytics enables an authenticated attacker to execute arbitrary code with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.