Urgent updates released for SonicWall SMA 100

SonicWall has released security updates for its Secure Mobile Access (SMA) 100 series appliances addressing multiple vulnerabilities, including critical flaws that could allow remote code execution or other unauthorised actions. Organisations using affected SMA 100 appliances should apply the latest firmware as soon as possible, since internet-facing remote access devices are a common target. Administrators should also review which systems are exposed and verify that updates have deployed successfully.

What this means for you if you run SMA 100 appliances

If you have an SMA 100 in service, it is worth thinking about what kind of box it is. A remote access appliance sits open to the internet by definition, and its job is to let people in. When it falls, the attacker is no longer outside your perimeter but inside it.

Our assessment is that this class of equipment easily gets overlooked in your vulnerability management. It is not a server anyone logs into daily. It is a box that simply sits there and works, right up until it does not.

Berigo recommends

• Apply the latest firmware to all SMA 100 appliances and confirm the version after updating.
• Maintain an inventory of all internet-facing equipment with a named owner and patching cadence.
• Review active sessions and administrator accounts on the appliance after updating.
• Consider whether some services behind the remote access appliance would be better placed behind a more modern access model.

Source

• psirt.global.sonicwall.com