CVE-2023-44221
Description
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
Summary dbcve.org
A command injection vulnerability exists in the SMA100 SSL-VPN management interface where improper neutralization of special elements allows an authenticated attacker with administrative privileges to inject and execute arbitrary operating system commands. The injected commands execute with the privileges of the 'nobody' user, rather than root, limiting direct root access but still allowing potential lateral movement and system compromise.
Mitigation
Apply the vendor-provided security patch for CVE-2023-44221 and review administrative user accounts to ensure only necessary personnel have management interface access.