CVE-2016-9682 EXPLOIT
9.8
CRITICAL · CVSS 3.0 · EPSS 23.3% (pctl 98)
Patch early
A public exploit exists.
Description
The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabilities in its web administrative interface. These vulnerabilities occur in the diagnostics CGI (/cgi-bin/diagnostics) component responsible for emailing out information about the state of the system. The application doesn't properly escape the information passed in the 'tsrDeleteRestartedFile' or 'currentTSREmailTo' variables before making a call to system(), allowing for remote command injection. Exploitation of this vulnerability yields shell access to the remote machine under the nobody user account.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 23.3% — more likely to be exploited than 98% of all CVEs |
| Weakness | CWE-77 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2017-02-22 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| dell | sonicwall secure remote access server |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Sonicwall Secure Remote Access 8.1.0.2-14sv - Command Injection | 2017-07-19 |
References
- http://documents.software.dell.com/sonicwall-sma-100-series/8.1.0.7/release-notes/resolved-issues?ParentProduct=868
- http://www.securityfocus.com/bid/96375
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2016-0003
- https://www.exploit-db.com/exploits/42342/
- http://documents.software.dell.com/sonicwall-sma-100-series/8.1.0.7/release-notes/resolved-issues?ParentProduct=868
- http://www.securityfocus.com/bid/96375
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2016-0003
- https://www.exploit-db.com/exploits/42342/
→ the Explorer · watch your stack · NVD