CVE-2023-34127

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analytics enables an authenticated attacker to execute arbitrary code with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.

Affected

SonicWall · GMS · Analytics

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

85.81% chance of exploitation in the next 30 days, 100th percentile

Published

2023-07-13

Updated

2025-04-23

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/sonicwall_shell_injec…

Security advisories

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010
• https://www.sonicwall.com/support/notices/230710150218060

References

• CVE Record
• NVD entry