SonicWall Patches Command Injection Flaw in Firewall Management Application

SonicWall last week announced the availability of patches for a severe vulnerability in its Network Security Manager (NSM) product.

NSM is a firewall management application that provides the ability to monitor and manage all network security services from a single interface, as well as to automate tasks to improve security operations. SonicWall’s platform is available both for on-premises deployments and as SaaS (Software-as-a-Service).

Tracked as CVE-2021-20026 and featuring a CVSS score of 8.8, the recently patched vulnerability impacts on-premises versions of SonicWall NSM, but does not affect NSM SaaS versions.

The issue, SonicWall reveals in a security advisory, is an OS command injection flaw that could be exploited by an attacker who has already been able to authenticate to a vulnerable system. The fact that authentication is required for exploitation lowers the severity of the flaw.

An authenticated attacker can send specially crafted HTTP requests to the vulnerable application to exploit the vulnerability.

“This critical vulnerability potentially allows a user to execute commands on a device’s operating system with the highest system privileges (root),” SonicWall explains.

The vulnerability impacts SonicWall NSM On-Prem 2.2.0-R10 and earlier releases, and was addressed with the release of NSM versions 2.2.1-R6 and 2.2.1-R6 (Enhanced).

In its advisory, SonicWall is urging all customers to apply the available patches as soon as possible, to ensure they remain protected.

“SonicWall customers using the on-premises NSM versions outlined […] should upgrade to the respective patched version immediately,” the company says.

Related: SonicWall Zero-Day Exploited by Ransomware Group Before It Was Patched

Related: Three Zero-Day Flaws in SonicWall Email Security Product Exploited in Attacks

Related: SonicWall Patches SMA Zero-Day Vulnerability Exploited in Attacks

Related: SonicWall Says Internal Systems Targeted by Hackers Exploiting Zero-Day Flaws