SonicWall SMA Appliances Under Attack: A Comedy of Errors in Cybersecurity
SonicWall SMA appliances have been under siege since January 2025, with attackers exploiting a remote code execution flaw. Arctic Wolf researchers reveal threat actors are stealing VPN credentials, exploiting the default super admin account’s weak password. Even fully patched devices are vulnerable if password hygiene is poor. Time to tighten those passwords, folks!
Hot Take:
The ultimate password fail: SonicWall’s SMA appliances are being exploited by attackers, not because of some super-sophisticated hack, but because people are still using “password” as a password. If only hackers had to answer a riddle instead, like “What has keys but can’t open locks?” Oh wait, that’s the SonicWall admins!
Key Points:
- SonicWall SMA appliances have been under attack since January 2025 due to a remote code execution flaw.
- The vulnerability, CVE-2021-20035, is an OS Command Injection Vulnerability in the SMA100 management interface.
- Despite a patch being released in September 2021, poor password practices still allow access.
- CISA has added this flaw to its Known Exploited Vulnerabilities catalog and demands fixes by May 7, 2025.
- Arctic Wolf reports attackers are exploiting the default admin account with the weak password “password.”
Already a member? Log in here