Secure Mobile Access (SMA)
CVE-2023-44221: SMA100 Appliances OS Command Injection
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| SMA100 (SMA 200, SMA 210, SMA 400, SMA 410, SMA 500v) 10.2 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
Exploitation
CISA lists this CVE as exploited in the wild since 1 May 2025.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.