CVE-2023-34127

HighCVSS 8.8

Published: 13/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

86.73%

100th percentile - higher than 100% of all known CVEs

Summary

CVE-2023-34127 describes an improper neutralization of special elements used in OS commands, allowing an authenticated attacker to execute arbitrary code with root privileges in SonicWall GMS and SonicWall Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.

Risk Assessment

An attacker with appropriate privileges can gain full control over the system, posing a serious threat to the security of the organization's data and infrastructure.

Recommendation

It is recommended to update to the latest versions of SonicWall GMS and Analytics to mitigate the risk associated with this vulnerability.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analytics enables an authenticated attacker to execute arbitrary code with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.