Vulnerability-Lookup

CVE-2024-53703 (GCVE-0-2024-53703)

Vulnerability from cvelistv5 – Published: 2024-12-05 13:59 – Updated: 2024-12-07 04:55

Summary

A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web server allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-06 00:00 UTC

CWE

CWE-121 - Stack-based Buffer Overflow

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version	CPE status
SonicWall	SMA100	Affected: 10.2.1.13-72sv and earlier versions	guessed
sonicwall	sma100_firmware	Affected: 0 , ≤ 10.2.1.13-72sv (custom) cpe:2.3:o:sonicwall:sma100_firmware::::::::

Date Public

2024-12-05 01:22

Credits

Alain Mowat of Orange Cyberdefense, Switzerland.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:sonicwall:sma100_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sma100_firmware",
            "vendor": "sonicwall",
            "versions": [
              {
                "lessThanOrEqual": "10.2.1.13-72sv",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-53703",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-06T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-07T04:55:30.933Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "SMA100",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "10.2.1.13-72sv and earlier versions"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alain Mowat of Orange Cyberdefense, Switzerland."
        }
      ],
      "datePublic": "2024-12-05T01:22:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web server allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e"
            }
          ],
          "value": "A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web server allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121 Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-05T13:59:35.490Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018"
        }
      ],
      "source": {
        "advisory": "SNWLID-2024-0018",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2024-53703",
    "datePublished": "2024-12-05T13:59:35.490Z",
    "dateReserved": "2024-11-22T09:54:04.963Z",
    "dateUpdated": "2024-12-07T04:55:30.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-53703",
      "date": "2026-09-16",
      "epss": "0.12632",
      "percentile": "0.96038"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web server allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad en el firmware SonicWall SMA100 SSLVPN 10.2.1.13-72sv y versiones anteriores de la librer\\u00eda mod_httprp cargada por el servidor web Apache permite a atacantes remotos provocar un desbordamiento del b\\u00fafer basado en pila y potencialmente conducir a la ejecuci\\u00f3n de c\\u00f3digo.\"}]",
      "id": "CVE-2024-53703",
      "lastModified": "2024-12-05T15:15:11.270",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.9}]}",
      "published": "2024-12-05T14:15:22.020",
      "references": "[{\"url\": \"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018\", \"source\": \"PSIRT@sonicwall.com\"}]",
      "sourceIdentifier": "PSIRT@sonicwall.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"PSIRT@sonicwall.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-121\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-53703\",\"sourceIdentifier\":\"PSIRT@sonicwall.com\",\"published\":\"2024-12-05T14:15:22.020\",\"lastModified\":\"2026-06-17T08:09:08.120\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web server allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en el firmware SonicWall SMA100 SSLVPN 10.2.1.13-72sv y versiones anteriores de la librer\u00eda mod_httprp cargada por el servidor web Apache permite a atacantes remotos provocar un desbordamiento del b\u00fafer basado en pila y potencialmente conducir a la ejecuci\u00f3n de c\u00f3digo.\"}],\"affected\":[{\"source\":\"PSIRT@sonicwall.com\",\"affectedData\":[{\"vendor\":\"SonicWall\",\"product\":\"SMA100\",\"defaultStatus\":\"unknown\",\"platforms\":[\"Linux\"],\"versions\":[{\"version\":\"10.2.1.13-72sv and earlier versions\",\"status\":\"affected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"sonicwall\",\"product\":\"sma100_firmware\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:sonicwall:sma100_firmware:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"10.2.1.13-72sv\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-12-06T00:00:00+00:00\",\"id\":\"CVE-2024-53703\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"PSIRT@sonicwall.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-121\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.2.1.14-75sv\",\"matchCriteriaId\":\"7F9F8CFF-F9A3-40EF-A630-62A2AC4681FA\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sonicwall:sma_200:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B190266-AD6F-401B-9B2E-061CDD539236\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sonicwall:sma_210_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.2.1.14-75sv\",\"matchCriteriaId\":\"013150EC-D511-4219-8668-805B6E6EA43F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sonicwall:sma_210:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"51587338-4A5F-41FC-9497-743F061947C2\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sonicwall:sma_400_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.2.1.14-75sv\",\"matchCriteriaId\":\"E74E33FD-25F4-443D-B20E-E5BE67310365\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sonicwall:sma_400:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D728332-10C9-4508-B720-569D44E99543\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sonicwall:sma_410_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.2.1.14-75sv\",\"matchCriteriaId\":\"E76E31C1-0DFA-4F7C-A7E9-9C9846AE6ED2\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sonicwall:sma_410:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9DFB8FBC-FFA4-4526-B306-D5692A43DC9E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sonicwall:sma_500v_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.2.1.14-75sv\",\"matchCriteriaId\":\"5E49B94A-119E-4C1D-81CD-3792F62AFE00\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:sonicwall:sma_500v:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A6AD8A33-7CE4-4C66-9E23-F0C9C9638770\"}]}]}],\"references\":[{\"url\":\"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018\",\"source\":\"PSIRT@sonicwall.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-28T21:31:54+00:00",
      "cve": "CVE-2024-53703",
      "id": "CVE-2024-53703",
      "initial_release_date": "2024-12-05T01:22:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2024-53703",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53703.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-53703\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-05T14:42:58.804722Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:sonicwall:sma100_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"sonicwall\", \"product\": \"sma100_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"10.2.1.13-72sv\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-05T15:06:52.557Z\"}}], \"cna\": {\"source\": {\"advisory\": \"SNWLID-2024-0018\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Alain Mowat of Orange Cyberdefense, Switzerland.\"}], \"affected\": [{\"vendor\": \"SonicWall\", \"product\": \"SMA100\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.2.1.13-72sv and earlier versions\"}], \"platforms\": [\"Linux\"], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2024-12-05T01:22:00.000Z\", \"references\": [{\"url\": \"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web server allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\\n\\n\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\\n\\n\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\\n\\n\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\\n\\n\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eA vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web server allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.\u003c/span\u003e\\n\\n\u003c/span\u003e\\n\\n\u003c/span\u003e\\n\\n\u003c/span\u003e\\n\\n\u003c/span\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-121\", \"description\": \"CWE-121 Stack-based Buffer Overflow\"}]}], \"providerMetadata\": {\"orgId\": \"44b2ff79-1416-4492-88bb-ed0da00c7315\", \"shortName\": \"sonicwall\", \"dateUpdated\": \"2024-12-05T13:59:35.490Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-53703\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-07T04:55:30.933Z\", \"dateReserved\": \"2024-11-22T09:54:04.963Z\", \"assignerOrgId\": \"44b2ff79-1416-4492-88bb-ed0da00c7315\", \"datePublished\": \"2024-12-05T13:59:35.490Z\", \"assignerShortName\": \"sonicwall\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CERTFR-2024-AVI-1042

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans Sonicwall Série Secure Mobile Access 100. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Sonicwall	Secure Mobile Access	Série Secure Mobile Access 100 (SMA 200, 210, 400, 410 et 500v) versions antérieures à 10.2.1.14-75sv

References

Title

Publication Time

CERTFR-2024-AVI-1042

Vulnerability from certfr_avis - Published: - Updated:

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Sonicwall	Secure Mobile Access	Série Secure Mobile Access 100 (SMA 200, 210, 400, 410 et 500v) versions antérieures à 10.2.1.14-75sv

References

Title

Publication Time

FKIE_CVE-2024-53703

Vulnerability from fkie_nvd - Published: 2024-12-05 14:15 - Updated: 2026-06-17 08:09

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	PSIRT@sonicwall.com	https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018	Vendor Advisory

Impacted products

Vendor	Product	Version
sonicwall	sma_200_firmware	*
sonicwall	sma_200	-
sonicwall	sma_210_firmware	*
sonicwall	sma_210	-
sonicwall	sma_400_firmware	*
sonicwall	sma_400	-
sonicwall	sma_410_firmware	*
sonicwall	sma_410	-
sonicwall	sma_500v_firmware	*
sonicwall	sma_500v	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "SMA100",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "10.2.1.13-72sv and earlier versions"
            }
          ]
        }
      ],
      "source": "PSIRT@sonicwall.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:sonicwall:sma100_firmware:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "sma100_firmware",
          "vendor": "sonicwall",
          "versions": [
            {
              "lessThanOrEqual": "10.2.1.13-72sv",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F9F8CFF-F9A3-40EF-A630-62A2AC4681FA",
              "versionEndExcluding": "10.2.1.14-75sv",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:sma_200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0B190266-AD6F-401B-9B2E-061CDD539236",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_210_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "013150EC-D511-4219-8668-805B6E6EA43F",
              "versionEndExcluding": "10.2.1.14-75sv",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:sma_210:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "51587338-4A5F-41FC-9497-743F061947C2",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_400_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E74E33FD-25F4-443D-B20E-E5BE67310365",
              "versionEndExcluding": "10.2.1.14-75sv",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:sma_400:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D728332-10C9-4508-B720-569D44E99543",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_410_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E76E31C1-0DFA-4F7C-A7E9-9C9846AE6ED2",
              "versionEndExcluding": "10.2.1.14-75sv",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:sma_410:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9DFB8FBC-FFA4-4526-B306-D5692A43DC9E",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_500v_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5E49B94A-119E-4C1D-81CD-3792F62AFE00",
              "versionEndExcluding": "10.2.1.14-75sv",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:sma_500v:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6AD8A33-7CE4-4C66-9E23-F0C9C9638770",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web server allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el firmware SonicWall SMA100 SSLVPN 10.2.1.13-72sv y versiones anteriores de la librer\u00eda mod_httprp cargada por el servidor web Apache permite a atacantes remotos provocar un desbordamiento del b\u00fafer basado en pila y potencialmente conducir a la ejecuci\u00f3n de c\u00f3digo."
    }
  ],
  "id": "CVE-2024-53703",
  "lastModified": "2026-06-17T08:09:08.120",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-53703",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-12-06T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-12-05T14:15:22.020",
  "references": [
    {
      "source": "PSIRT@sonicwall.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018"
    }
  ],
  "sourceIdentifier": "PSIRT@sonicwall.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ],
      "source": "PSIRT@sonicwall.com",
      "type": "Secondary"
    }
  ]
}

GHSA-9M9P-7XR9-44FF

Vulnerability from github – Published: 2024-12-05 15:31 – Updated: 2024-12-05 15:31

Details

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-53703"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-121"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-05T14:15:22Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web server allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.",
  "id": "GHSA-9m9p-7xr9-44ff",
  "modified": "2024-12-05T15:31:02Z",
  "published": "2024-12-05T15:31:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53703"
    },
    {
      "type": "WEB",
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2024-0464

Vulnerability from csaf_ncscnl - Published: 2024-12-06 11:48 - Updated: 2024-12-06 11:48

Summary

Kwetsbaarheden verholpen in SonicWall SMA100 SSLVPN

Scope

6 vulnerabilities in this advisory, including CVE-2024-53703.

CVE-2024-53703

Known affected: 2 products

Open the full advisory

WID-SEC-W-2024-3623

Vulnerability from csaf_certbund - Published: 2024-12-05 23:00 - Updated: 2024-12-05 23:00

Summary

SonicWall SMA: Mehrere Schwachstellen

Severity

Hoch

Scope

5 vulnerabilities in this advisory, including CVE-2024-53703.

CVE-2024-53703

Es besteht eine Schwachstelle in der SonicWall SMA 100 Serie. Dieser Fehler existiert wegen eines stapelbasierten Pufferüberlaufs in der vom Apache-Webserver geladenen SSLVPN mod_httprp-Bibliothek. Ein entfernter, anonymer Angreifer kann diese Schwachstelle zur Ausführung von beliebigem Code ausnutzen.

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-53703 (GCVE-0-2024-53703)

CERTFR-2024-AVI-1042

Solutions

CERTFR-2024-AVI-1042

Solutions

FKIE_CVE-2024-53703

GHSA-9M9P-7XR9-44FF

NCSC-2024-0464

WID-SEC-W-2024-3623

Tags

Sightings

Nomenclature

Related by attack behaviour