This page lists publicly disclosed CVE vulnerabilities affecting sonicwall sma_410_firmware (linked via NVD CPE). Each row includes severity scores, summaries, and publication dates to help identify and analyze security issues.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2025-40603 | A potential exposure of sensitive information in log files in SonicWall SMA100 Series appliances may allow a remote, authenticated administrator, under certain conditions to view partial users credential data. | [email protected] | 4.5 | 0.38% | 2025-10-31 | 2026-06-17 |
| CVE-2025-40598 | A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code. | [email protected] | 6.1 | 53.21% | 2025-07-23 | 2026-06-17 |
| CVE-2025-40597 | A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution. | [email protected] | 7.5 | 27.60% | 2025-07-23 | 2026-06-17 |
| CVE-2025-40596 | A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution. | [email protected] | 7.3 | 56.06% | 2025-07-23 | 2026-06-17 |
| CVE-2025-40599 | An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution. | [email protected] | 9.1 | 11.63% | 2025-07-23 | 2026-06-17 |
| CVE-2025-32821 | A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell command arguments to upload a file on the appliance. | [email protected] | 7.2 | 31.54% | 2025-05-07 | 2026-06-17 |
| CVE-2025-32820 | A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make any directory on the SMA appliance writable. | [email protected] | 8.8 | 2.97% | 2025-05-07 | 2026-06-17 |
| CVE-2025-32819 | A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings. | [email protected] | 8.8 | 6.79% | 2025-05-07 | 2026-06-17 |
| CVE-2024-53703 | A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web server allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution. | [email protected] | 8.1 | 12.71% | 2024-12-05 | 2026-06-17 |
| CVE-2024-53702 | Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup code generator that, in certain cases, can be predicted by an attacker, potentially exposing the generated secret. | [email protected] | 5.3 | 0.33% | 2024-12-05 | 2026-06-17 |
| CVE-2024-45319 | A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions allows a remote authenticated attacker can circumvent the certificate requirement during authentication. | [email protected] | 6.3 | 0.23% | 2024-12-05 | 2026-06-17 |
| CVE-2024-45318 | A vulnerability in the SonicWall SMA100 SSLVPN web management interface allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution. | [email protected] | 8.1 | 1.04% | 2024-12-05 | 2026-06-17 |
| CVE-2024-40763 | Heap-based buffer overflow vulnerability in the SonicWall SMA100 SSLVPN due to the use of strcpy. This allows remote authenticated attackers to cause Heap-based buffer overflow and potentially lead to code execution. | [email protected] | 7.5 | 0.95% | 2024-12-05 | 2026-06-17 |
| CVE-2024-38475 KEV | Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag | [email protected] | 9.1 | 99.96% | 2024-07-01 | 2026-06-17 |
| CVE-2024-22395 | Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a remote authenticated attacker to associate another user's MFA mobile application. | [email protected] | 6.3 | 0.43% | 2024-02-23 | 2026-06-17 |
| CVE-2023-5970 | Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using accent characters, resulting in an MFA bypass. | [email protected] | 8.8 | 0.91% | 2023-12-05 | 2026-06-17 |
| CVE-2023-44221 KEV | Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability. | [email protected] | 7.2 | 74.93% | 2023-12-05 | 2026-06-17 |
| CVE-2022-2915 | A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to cause Denial of Service (DoS) on the appliance or potentially lead to code execution. This vulnerability impacts 10.2.1.5-34sv and earlier versions. | [email protected] | 8.8 | 1.36% | 2022-08-26 | 2026-06-17 |
| CVE-2022-1703 | Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Commands which potentially leads to remote command execution vulnerability or denial of service (DoS) attack. | [email protected] | 8.8 | 11.11% | 2022-06-08 | 2026-06-17 |
| CVE-2022-22279 | A post-authentication arbitrary file read vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier versions and Secure Mobile Access (SMA) 100 series products running older firmware 9.0.0.9-26sv and earlier versions | [email protected] | 4.9 | 1.07% | 2022-04-13 | 2026-06-17 |