Unscored CVE-2023-5970 EUVD-2023-58238GHSA-8w95-32fx-8c6h

Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external …

Published Dec 5, 2023 · Updated Aug 2, 2024 · Assigned by sonicwall

Vendor: SonicWall Product: SMA100 Category: Network devices

Description

Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using accent characters, resulting in an MFA bypass.

Affected products

Vendor	Product	Affected	Fixed
SonicWall	SMA100	10.2.1.9-57sv and earlier versions	—

Advisories 1

WID-SEC-2023-3054 SonicWall SMA: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 1, 2025

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018 vendor-advisory