Secure Mobile Access (SMA)
CVE-2023-5970: Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker…
Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using accent characters, resulting in an MFA bypass.
Published
ExploitedNot in CISA KEV
Ransomware useNot reportedPer CISA
SeverityUnknown
EPSS0.91%Chance of exploitation in 30 days
Public exploitNot tracked
FixSee advisory
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| SMA100 (SMA 200, SMA 210, SMA 400, SMA 410, SMA 500v) 10.2 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using accent characters, resulting in an MFA bypass.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.