SonicWall SMA 100 Series 10.x Firmware Zero-Day Vulnerability

Attacker Value

Very High

SonicWall SMA 100 Series 10.x Firmware Zero-Day Vulnerability

Description

Recently, SonicWall identified a coordinated attack on its internal systems by highly sophisticated threat actors exploiting probable zero-day vulnerabilities on certain SonicWall secure remote access products. The impacted products are:

Secure Mobile Access (SMA) version 10.x running on SMA 200, SMA 210, SMA 400, SMA 410 physical appliances and the SMA 500v virtual appliance

Add Assessment

wvu-r7 (437)

February 04, 2021 10:34pm UTC (3 years ago)•Edited 3 years ago

Ratings

Attacker Value

Very High

Exploitability

High

Common in enterprise Unauthenticated

Technical Analysis

Please see the Rapid7 analysis.

Exploited in the Wild

Reported by:

wvu-r7

Reported: February 04, 2021 7:34pm UTC (3 years ago)

ccondon-r7 indicated source as News Article or Blog (https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html)

Reported: May 12, 2021 3:48pm UTC (3 years ago)

gwillcox-r7 indicated sources as

Government or Industry Alert (https://www.ic3.gov/Media/News/2021/211029.pdf)
News Article or Blog (https://securityaffairs.co/wordpress/124059/malware/hellokitty-ransomware-fbi-alert.html)

Reported: November 03, 2021 9:30pm UTC (3 years ago) • Edited 2 years ago

AttackerKB Worker indicated source as Government or Industry Alert (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

Reported: November 08, 2024 8:17am UTC (1 month ago)

References

Rapid7

February 04, 2021 10:33pm UTC (3 years ago)• Last updated May 14, 2021 5:46pm UTC (3 years ago)

Technical Analysis

Threat status: Threat (actively exploited)
Attacker utility: Network pivot

Description

Update May 12, 2021: FireEye published a report this week noting that the DarkSide ransomware operators are using CVE-2021-20016 as an initial compromise vector in their extortion attacks. Recent reports have indicated that ransomware operations are targeting externally-facing corporate infrastructure—we strongly recommend keeping network pivots (including VPNs, firewalls, and internet-facing load balancers) up-to-date on a short patch cycle.

On January 22, 2021, SonicWall published a security alert explaining that they had been compromised by unknown threat actors utilizing probable zero-day vulnerabilities in their own products. Through the subsequent week, SonicWall narrowed down the affected products to SMA 100 series appliances running firmware versions 10.x.

On January 31, 2021, NCC Group tweeted that they had observed “indiscriminate” exploitation of a zero-day vulnerability in the wild, potentially the one identified by SonicWall. This vulnerability is being tracked as CVE-2021-20016, an SQL injection that allows remote, unauthenticated attackers access to credential and session information. More information can be found in the SonicWall security advisory.

On February 3, 2021, SonicWall released SMA 100 series firmware version 10.2.0.5-29sv to patch CVE-2021-20016. Rapid7 urges SonicWall customers to upgrade immediately, as CVE-2021-20016 is considered a widespread threat due to NCC Group’s findings.

Affected products

Affected SMA 100 Devices with 10.x Firmware that Require the Critical Patch:

Physical Appliances: SMA 200, SMA 210, SMA 400, SMA 410
Virtual Appliances: SMA 500v (Azure, AWS, ESXi, HyperV)

Rapid7 analysis

Web path /cgi-bin contains numerous ELF binaries, some even SUID-root. The web interface is built on Apache and uses these binaries in conjunction with an SQLite backend.

root@sslvpn:/usr/src/EasyAccess/www/cgi-bin # ls -l
total 7330
-rwxr-xr-x 1 root root  17664 Feb  3 07:16 DEARegister
-rwxr-xr-x 1 root root     52 Feb  3 07:16 DEARegister.html
-rwxr-xr-x 1 root root   5163 Feb  3 07:16 FileSharesJavaApplet.html
-rwxr-xr-x 1 root root   1779 Feb  3 07:16 FileSharesJavaAppletLauncher.html
-rwxr-xr-x 1 root root   3424 Feb  3 07:16 HTTPReverseProxy.class
-rwxr-xr-x 1 root root   7331 Feb  3 07:16 MeetingInfo.html
-rwxr-xr-x 1 root root   2712 Feb  3 07:16 SNWL-COMMON-MIB.MIB
-rwxr-xr-x 1 root root   4856 Feb  3 07:16 SNWL-SSLVPN-MIB.MIB
-rwxr-xr-x 1 root root   3178 Feb  3 07:16 SONICWALL-SMI.MIB
-rwsr-sr-x 1 root root   5368 Feb  3 07:16 SSLVPNState.xml
-rwxr-xr-x 1 root root  10993 Feb  3 07:16 VirtualMeeting.html
-rwxr-xr-x 1 root root   2772 Feb  3 07:16 VirtualMeetingPlugin.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 about
-rwxr-xr-x 1 root root  61711 Feb  3 07:16 about.html
-rwsr-sr-x 1 root root  17656 Feb  3 07:16 activeusers
-rwxr-xr-x 1 root root   4285 Feb  3 07:16 activeusers1.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 addDevice
-rwxr-xr-x 1 root root   3694 Feb  3 07:16 addDevice1.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 addDevicePolicy
-rwxr-xr-x 1 root root   2973 Feb  3 07:16 addDevicePolicy.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 addclientroutes
-rwxr-xr-x 1 root root   4200 Feb  3 07:16 addclientroutes1.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 adddefaddr
-rwxr-xr-x 1 root root   4119 Feb  3 07:16 adddefaddr1.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 adddefbrowser
-rwxr-xr-x 1 root root   3968 Feb  3 07:16 adddefbrowser1.html
-rwxr-xr-x 1 root root  38136 Feb  3 07:16 adddomain
-rwxr-xr-x 1 root root  73801 Feb  3 07:16 adddomain1.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 addgroup
-rwxr-xr-x 1 root root   3354 Feb  3 07:16 addgroup1.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 addhosts
-rwxr-xr-x 1 root root   2460 Feb  3 07:16 addhosts1.html
-rwxr-xr-x 1 root root  21752 Feb  3 07:16 addpolicy
-rwxr-xr-x 1 root root  31509 Feb  3 07:16 addpolicy1.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 addresource
-rwxr-xr-x 1 root root   2923 Feb  3 07:16 addresource1.html
-rwxr-xr-x 1 root root  10697 Feb  3 07:16 addresourceaddr1.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 addresourceaddrs
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 addstaticroutes
-rwxr-xr-x 1 root root   3438 Feb  3 07:16 addstaticroutes1.html
-rwxr-xr-x 1 root root     61 Feb  3 07:16 addstaticroutes2.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 adduser
-rwxr-xr-x 1 root root   6714 Feb  3 07:16 adduser1.html
-rwxr-xr-x 1 root root   2569 Feb  3 07:16 adduser2.html
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 adminHelp
-rwxr-xr-x 1 root root    509 Feb  3 07:16 adminHelp.html
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 adminHelpBody
-rwxr-xr-x 1 root root 101369 Feb  3 07:16 adminHelpBody.html
-rwxr-xr-x 1 root root  14088 Feb  3 07:16 analyzer
-rwxr-xr-x 1 root root   3217 Feb  3 07:16 analyzer1.html
-rwxr-xr-x 1 root root   2905 Feb  3 07:16 analyzer2.html
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 appOffloadMenu
-rwxr-xr-x 1 root root   4946 Feb  3 07:16 appOffloadMenu.html
-rwxr-xr-x 1 root root   1218 Feb  3 07:16 appOffloadRedirect.html
-rwsr-sr-x 1 root root  34824 Feb  3 07:16 backup
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 backupcode
-rwxr-xr-x 1 root root   1367 Feb  3 07:16 backupcode1.html
-rwxr-xr-x 1 root root   9468 Feb  3 07:16 bandwidthTest
-rwxr-xr-x 1 root root  17449 Feb  3 07:16 bandwidthTest.html
-rwxr-xr-x 1 root root  17656 Feb  3 07:16 bookmarkDetails
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 bookmarks
-rwxr-xr-x 1 root root   3541 Feb  3 07:16 bookmarks1.html
-rwxr-xr-x 1 root root    403 Feb  3 07:16 bookmarks2.html
-rwsr-sr-x 1 root root  34824 Feb  3 07:16 boot
-rwxr-xr-x 1 root root   1434 Feb  3 07:16 browser_error.html
-rwxr-xr-x 1 root root  25848 Feb  3 07:16 capacityMatrixReport
-rwxr-xr-x 1 root root   5955 Feb  3 07:16 captureATPConfig.html
-rwxr-xr-x 1 root root   1839 Feb  3 07:16 captureATPLicense.html
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 captureATPReport
-rwxr-xr-x 1 root root   1439 Feb  3 07:16 captureATPReport.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 captureatpconfig
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 captureatplicense
-rwxr-xr-x 1 root root  42292 Feb  3 07:16 cifslauncher
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 cifslogout
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 cifsnavigate
-rwxr-xr-x 1 root root  38196 Feb  3 07:16 cifsrename
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 citrixICA
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 citrix_installer
-rwxr-xr-x 1 root root  21752 Feb  3 07:16 clientaddresses
-rwxr-xr-x 1 root root  17065 Feb  3 07:16 clientaddresses1.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 clientdownload
-rwxr-xr-x 1 root root   3176 Feb  3 07:16 clientdownload.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 clientdownloads
-rwxr-xr-x 1 root root   5936 Feb  3 07:16 clientdownloads.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 clientroutes
-rwxr-xr-x 1 root root   2167 Feb  3 07:16 clientroutes1.html
-rwxr-xr-x 1 root root    745 Feb  3 07:16 clientroutes2.html
-rwxr-xr-x 1 root root   8242 Feb  3 07:16 customLogin1.html
-rwxr-xr-x 1 root root   1368 Feb  3 07:16 customOtp1.html
-rwxr-xr-x 1 root root   3578 Feb  3 07:16 customOtp2.html
-rwxr-xr-x 1 root root   1859 Feb  3 07:16 customOtpError1.html
-rwxr-xr-x 1 root root    794 Feb  3 07:16 customOtpError2.html
-rwxr-xr-x 1 root root   1807 Feb  3 07:16 customRsaNewPin.html
-rwxr-xr-x 1 root root   2922 Feb  3 07:16 customRsaNextCode.html
-rwxr-xr-x 1 root root   1658 Feb  3 07:16 customRsaSysPin.html
-rwsr-sr-x 1 root root  14088 Feb  3 07:16 date
-rwxr-xr-x 1 root root   4003 Feb  3 07:16 date1.html
-rwxr-xr-x 1 root root    422 Feb  3 07:16 date2.html
-rwxr-xr-x 1 root root    787 Feb  3 07:16 date3.html
-rwsr-sr-x 1 root root  34824 Feb  3 07:16 deleteFw
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 deletePortalBookmark
-rwxr-xr-x 1 root root   3093 Feb  3 07:16 detect_launch.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 devicePolicies
-rwxr-xr-x 1 root root   2942 Feb  3 07:16 devicePolicies.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 deviceSettings
-rwxr-xr-x 1 root root  13240 Feb  3 07:16 deviceSettings.html
-rwxr-xr-x 1 root root  25848 Feb  3 07:16 devices
-rwxr-xr-x 1 root root  15918 Feb  3 07:16 devices1.html
-rwxr-xr-x 1 root root   1668 Feb  3 07:16 devices2.html
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 diag
-rwxr-xr-x 1 root root   1833 Feb  3 07:16 diag1.html
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 diagOutlook
-rwxr-xr-x 1 root root   4564 Feb  3 07:16 diagOutlook.html
-rwxr-xr-x 1 root root  46336 Feb  3 07:16 diagnostics
-rwxr-xr-x 1 root root  22903 Feb  3 07:16 diagnostics1.html
-rwxr-xr-x 1 root root   1004 Feb  3 07:16 diagnostics2.html
-rwxr-xr-x 1 root root    417 Feb  3 07:16 diagnostics3.html
-rwsr-sr-x 1 root root  17656 Feb  3 07:16 diagsettings
-rwxr-xr-x 1 root root  15291 Feb  3 07:16 diagsettings1.html
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 disclaimer
-rwxr-xr-x 1 root root   1025 Feb  3 07:16 disclaimer.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 dnssettings
-rwxr-xr-x 1 root root   7652 Feb  3 07:16 dnssettings1.html
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 domainList
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 domains
-rwxr-xr-x 1 root root   3698 Feb  3 07:16 domains1.html
-rwsr-sr-x 1 root root  34824 Feb  3 07:16 download
-rwxr-xr-x 1 root root  17656 Feb  3 07:16 editAdGroup
-rwxr-xr-x 1 root root   5499 Feb  3 07:16 editAdGroup.html
-rwxr-xr-x 1 root root  50424 Feb  3 07:16 editBookmark
-rwxr-xr-x 1 root root  52641 Feb  3 07:16 editBookmark.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 editRadiusGroup
-rwxr-xr-x 1 root root   2772 Feb  3 07:16 editRadiusGroup.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 editSamlGroup
-rwxr-xr-x 1 root root   2730 Feb  3 07:16 editSamlGroup.html
-rwxr-xr-x 1 root root  17656 Feb  3 07:16 editSmsTemplate
-rwxr-xr-x 1 root root   8660 Feb  3 07:16 editSmsTemplate.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 editWAFSignature
-rwxr-xr-x 1 root root   9346 Feb  3 07:16 editWAFSignature.html
-rwxr-xr-x 1 root root  50424 Feb  3 07:16 editdomain
-rwxr-xr-x 1 root root  74089 Feb  3 07:16 editdomain.html
-rwxr-xr-x 1 root root  17656 Feb  3 07:16 editepc
-rwxr-xr-x 1 root root   8253 Feb  3 07:16 editepc.html
-rwxr-xr-x 1 root root  42236 Feb  3 07:16 editglobal
-rwxr-xr-x 1 root root  18595 Feb  3 07:16 editglobal1.html
-rwxr-xr-x 1 root root  10453 Feb  3 07:16 editglobal2.html
-rwxr-xr-x 1 root root    469 Feb  3 07:16 editglobal3.html
-rwxr-xr-x 1 root root   2553 Feb  3 07:16 editglobal4.html
-rwxr-xr-x 1 root root    345 Feb  3 07:16 editglobal5.html
-rwxr-xr-x 1 root root   3749 Feb  3 07:16 editglobal6.html
-rwxr-xr-x 1 root root  58616 Feb  3 07:16 editgroups
-rwxr-xr-x 1 root root  67824 Feb  3 07:16 editgroups1.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 edithosts
-rwxr-xr-x 1 root root   2935 Feb  3 07:16 edithosts1.html
-rwxr-xr-x 1 root root  17656 Feb  3 07:16 editresource
-rwxr-xr-x 1 root root   6440 Feb  3 07:16 editresource1.html
-rwxr-xr-x 1 root root  79096 Feb  3 07:16 editusers
-rwxr-xr-x 1 root root  88218 Feb  3 07:16 editusers1.html
-rwxr-xr-x 1 root root    451 Feb  3 07:16 editusers2.html
-rwxr-xr-x 1 root root  10225 Feb  3 07:16 editusers3.html
-rwxr-xr-x 1 root root   1245 Feb  3 07:16 editusers4.html
-rwxr-xr-x 1 root root   9717 Feb  3 07:16 editusers5.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 editvpserver
-rwxr-xr-x 1 root root   2447 Feb  3 07:16 editvpserver.html
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 encryptoptions
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 endpointsecurity
-rwxr-xr-x 1 root root   1769 Feb  3 07:16 endpointsecurity1.html
-rwxr-xr-x 1 root root     46 Feb  3 07:16 endpointsecurity2.html
-rwxr-xr-x 1 root root  46388 Feb  3 07:16 entirenetwork
-rwxr-xr-x 1 root root   8631 Feb  3 07:16 entirenetwork1.html
-rwxr-xr-x 1 root root    214 Feb  3 07:16 entirenetwork2.html
-rwxr-xr-x 1 root root  34040 Feb  3 07:16 epcValidate
-rwxr-xr-x 1 root root   2728 Feb  3 07:16 epcValidate.html
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 epclicense
-rwxr-xr-x 1 root root   2684 Feb  3 07:16 epclicense.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 epcquarantine
-rwxr-xr-x 1 root root   2887 Feb  3 07:16 epcquarantine1.html
-rwxr-xr-x 1 root root   1938 Feb  3 07:16 epcquarantine2.html
-rwxr-xr-x 1 root root  30192 Feb  3 07:16 epcs
-rwxr-xr-x 1 root root   2392 Feb  3 07:16 epcs1.html
-rwxr-xr-x 1 root root    832 Feb  3 07:16 epcs2.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 epcsettings
-rwxr-xr-x 1 root root   7006 Feb  3 07:16 epcsettings.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 epcstatus
-rwxr-xr-x 1 root root   5852 Feb  3 07:16 epcstatus.html
-rwxr-xr-x 1 root root   1084 Feb  3 07:16 error.html
-rwxr-xr-x 1 root root   1874 Feb  3 07:16 errorAnonymous.html
-rwxr-xr-x 1 root root   1775 Feb  3 07:16 errorCSRF.html
-rwxr-xr-x 1 root root   1137 Feb  3 07:16 errorLicense.html
-rwxr-xr-x 1 root root   1113 Feb  3 07:16 errorLicense_AO.html
-rwxr-xr-x 1 root root   1142 Feb  3 07:16 error_AO.html
-rwxr-xr-x 1 root root   1176 Feb  3 07:16 errordns.html
-rwxr-xr-x 1 root root   1233 Feb  3 07:16 errordns_AO.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 etchosts
-rwxr-xr-x 1 root root   4836 Feb  3 07:16 etchosts1.html
-rwxr-xr-x 1 root root  61497 Feb  3 07:16 eua.html
-rwsr-sr-x 1 root root  50984 Feb  3 07:16 eventlog
-rwxr-xr-x 1 root root  15344 Feb  3 07:16 eventlog1.html
-rwxr-xr-x 1 root root    827 Feb  3 07:16 eventlog2.html
-rwxr-xr-x 1 root root  38196 Feb  3 07:16 explorercomputer
-rwxr-xr-x 1 root root   8893 Feb  3 07:16 explorercomputer2.html
-rwxr-xr-x 1 root root    214 Feb  3 07:16 explorercomputer3.html
-rwxr-xr-x 1 root root   3135 Feb  3 07:16 explorererror1.html
-rwxr-xr-x 1 root root   4701 Feb  3 07:16 explorererror2.html
-rwxr-xr-x 1 root root    224 Feb  3 07:16 explorererror3.html
-rwxr-xr-x 1 root root  46388 Feb  3 07:16 explorerfiles
-rwxr-xr-x 1 root root   3178 Feb  3 07:16 explorerfiles1.html
-rwxr-xr-x 1 root root   5732 Feb  3 07:16 explorerfiles2.html
-rwxr-xr-x 1 root root   2668 Feb  3 07:16 explorerfiles3.html
-rwxr-xr-x 1 root root   2720 Feb  3 07:16 explorerfiles4.html
-rwxr-xr-x 1 root root    214 Feb  3 07:16 explorerfiles5.html
-rwxr-xr-x 1 root root  66868 Feb  3 07:16 explorerlist
-rwxr-xr-x 1 root root   4692 Feb  3 07:16 explorershares.html
-rwxr-xr-x 1 root root   4781 Feb  3 07:16 explorershares0.html
-rwsr-sr-x 1 root root  29944 Feb  3 07:16 exportConfigFile
-rwsr-sr-x 1 root root  42232 Feb  3 07:16 exportDiagnostics
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 extendauthentication
-rwxr-xr-x 1 root root  30472 Feb  3 07:16 extensionsetting
-rwxr-xr-x 1 root root  16814 Feb  3 07:16 extensionsetting1.html
-rwxr-xr-x 1 root root    747 Feb  3 07:16 extensionsetting2.html
-rwxr-xr-x 1 root root   3064 Feb  3 07:16 ffdeadplugins.html
-rwxr-xr-x 1 root root  46388 Feb  3 07:16 filePermissions
-rwxr-xr-x 1 root root  21779 Feb  3 07:16 fileshare.html
-rwxr-xr-x 1 root root   1436 Feb  3 07:16 ftp-addnew1.html
-rwxr-xr-x 1 root root    985 Feb  3 07:16 ftp-addnew2.html
-rwxr-xr-x 1 root root    770 Feb  3 07:16 ftp-addnew3.html
-rwxr-xr-x 1 root root    514 Feb  3 07:16 ftp-addnew4.html
-rwxr-xr-x 1 root root  12464 Feb  3 07:16 ftp-download1.html
-rwxr-xr-x 1 root root   1799 Feb  3 07:16 ftp-rename1.html
-rwxr-xr-x 1 root root   1449 Feb  3 07:16 ftp-rename2.html
-rwxr-xr-x 1 root root   1391 Feb  3 07:16 ftp-upload1.html
-rwxr-xr-x 1 root root   1616 Feb  3 07:16 ftp-upload2.html
-rwxr-xr-x 1 root root   6089 Feb  3 07:16 ftp-upload3.html
-rwxr-xr-x 1 root root   4053 Feb  3 07:16 ftp1.html
-rwxr-xr-x 1 root root    652 Feb  3 07:16 ftp2.html
-rwxr-xr-x 1 root root    702 Feb  3 07:16 ftp3.html
-rwxr-xr-x 1 root root    456 Feb  3 07:16 ftp4.html
-rwxr-xr-x 1 root root    224 Feb  3 07:16 ftpMaxSession.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 ftplauncher
-rwsr-sr-x 1 root root   9464 Feb  3 07:16 genCert
-rwxr-xr-x 1 root root   2943 Feb  3 07:16 genCert1.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 gencsr
-rwxr-xr-x 1 root root  17656 Feb  3 07:16 geoBotAddPolicy
-rwxr-xr-x 1 root root  33742 Feb  3 07:16 geoBotAddPolicy.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 geoBotCaptcha
-rwxr-xr-x 1 root root   3509 Feb  3 07:16 geoBotCaptcha.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 geoBotLicense
-rwxr-xr-x 1 root root   2298 Feb  3 07:16 geoBotLicense.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 geoBotPolicyList
-rwxr-xr-x 1 root root   7167 Feb  3 07:16 geoBotPolicyList.html
-rwxr-xr-x 1 root root  17696 Feb  3 07:16 geoBotStatus
-rwxr-xr-x 1 root root  13889 Feb  3 07:16 geoBotStatus.html
-rwxr-xr-x 1 root root   1108 Feb  3 07:16 geoBotValidated.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 geoDetailed
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 geoipBotFltSettings
-rwxr-xr-x 1 root root  11125 Feb  3 07:16 geoipBotFltSettings.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 getaovconf
-rwsr-sr-x 1 root root  25848 Feb  3 07:16 gmssetup
-rwxr-xr-x 1 root root  31671 Feb  3 07:16 gmssetup1.html
-rwxr-xr-x 1 root root   1139 Feb  3 07:16 graph.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 groups
-rwxr-xr-x 1 root root   1933 Feb  3 07:16 groups1.html
-rwxr-xr-x 1 root root    244 Feb  3 07:16 groups2.html
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 haSingleInfWarning
-rwxr-xr-x 1 root root   1661 Feb  3 07:16 haSingleInfWarning.html
-rwxr-xr-x 1 root root  17680 Feb  3 07:16 haconfig
-rwxr-xr-x 1 root root  16429 Feb  3 07:16 haconfig.html
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 handleFailOverError
-rwxr-xr-x 1 root root  17656 Feb  3 07:16 handleWAFDetect
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 handleWAFRedirect
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 html5ClientLog
-rwxr-xr-x 1 root root  17656 Feb  3 07:16 http
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 https
-rwsr-sr-x 1 root root  13560 Feb  3 07:16 ifacesettings
-rwxr-xr-x 1 root root   9879 Feb  3 07:16 ifacesettings1.html
-rwxr-xr-x 1 root root  13568 Feb  3 07:16 importDevices
-rwxr-xr-x 1 root root   3485 Feb  3 07:16 importDevices.html
-rwxr-xr-x 1 root root  13564 Feb  3 07:16 importLocalUsers
-rwxr-xr-x 1 root root   2232 Feb  3 07:16 importLocalUsers.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 importcacert
-rwxr-xr-x 1 root root   1813 Feb  3 07:16 importcacert1.html
-rwsr-sr-x 1 root root  13560 Feb  3 07:16 importcert
-rwxr-xr-x 1 root root   2350 Feb  3 07:16 importcert1.html
-rwsr-sr-x 1 root root  22156 Feb  3 07:16 importconfig
-rwxr-xr-x 1 root root   2505 Feb  3 07:16 importconfig.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 importlogo
-rwxr-xr-x 1 root root   1892 Feb  3 07:16 importsamlcert1.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 installcert
-rwxr-xr-x 1 root root   3760 Feb  3 07:16 installcert1.html
-rwxr-xr-x 1 root root   3310 Feb  3 07:16 jarrewrite.sh
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 javaBadVersion
-rwxr-xr-x 1 root root   1536 Feb  3 07:16 javaBadVersion.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 javaVersionTest
-rwxr-xr-x 1 root root   3457 Feb  3 07:16 javaVersionTest.html
-rwxr-xr-x 1 root root  40001 Feb  3 07:16 jdasm
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 layout
-rwxr-xr-x 1 root root   1432 Feb  3 07:16 layout1.html
-rwxr-xr-x 1 root root  17656 Feb  3 07:16 lbGroup
-rwxr-xr-x 1 root root  16048 Feb  3 07:16 lbGroup.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 lbMain
-rwxr-xr-x 1 root root   6283 Feb  3 07:16 lbMain.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 lbMember
-rwxr-xr-x 1 root root   4804 Feb  3 07:16 lbMember.html
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 license
-rwxr-xr-x 1 root root   1323 Feb  3 07:16 license.html
-rwxr-xr-x 1 root root   8267 Feb  3 07:16 licenseOffline.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 licenseTop
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 logcategories
-rwxr-xr-x 1 root root   3846 Feb  3 07:16 logcategories1.html
-rwxr-xr-x 1 root root  18184 Feb  3 07:16 logconfig
-rwxr-xr-x 1 root root  10217 Feb  3 07:16 logconfig1.html
-rwxr-xr-x 1 root root   2694 Feb  3 07:16 logconfig2.html
-rwxr-xr-x 1 root root  10263 Feb  3 07:16 login1.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 loginChangePass
-rwxr-xr-x 1 root root    934 Feb  3 07:16 loginChangePass.html
-rwxr-xr-x 1 root root   3998 Feb  3 07:16 loginMobile.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 logindialogue
-rwxr-xr-x 1 root root   2707 Feb  3 07:16 logindialogue.html
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 logo
-rwxr-xr-x 1 root root   5307 Feb  3 07:16 logo.html
-rwxr-xr-x 1 root root   2915 Feb  3 07:16 logout.html
-rwxr-xr-x 1 root root   1944 Feb  3 07:16 mainwindow1.html
-rwxr-xr-x 1 root root   1506 Feb  3 07:16 mainwindow2.html
-rwxr-xr-x 1 root root   1201 Feb  3 07:16 mainwindow3.html
-rwxr-xr-x 1 root root   9488 Feb  3 07:16 management
-rwxr-xr-x 1 root root   3233 Feb  3 07:16 management.html
-rwsr-sr-x 1 root root  17656 Feb  3 07:16 monitor
-rwxr-xr-x 1 root root   4526 Feb  3 07:16 monitor1.html
-rwxr-xr-x 1 root root   6766 Feb  3 22:08 ms_csrf.js
-rwxr-xr-x 1 root root   3388 Feb  3 07:16 nelaunch0.html
-rwxr-xr-x 1 root root    547 Feb  3 07:16 nelaunch1.html
-rwxr-xr-x 1 root root  26730 Feb  3 07:16 nelaunch2.html
-rwxr-xr-x 1 root root  38664 Feb  3 07:16 netextenderlog
-rwxr-xr-x 1 root root   1139 Feb  3 07:16 netextenderlog.html
-rwxr-xr-x 1 root root  24205 Feb  3 07:16 netextenderlogTop.html
-rwxr-xr-x 1 root root  21752 Feb  3 07:16 netextenderstats
-rwxr-xr-x 1 root root   6451 Feb  3 07:16 netextenderstats1.html
-rwsr-sr-x 1 root root  13560 Feb  3 07:16 networkinterface
-rwxr-xr-x 1 root root   2477 Feb  3 07:16 networkinterface1.html
-rwxr-xr-x 1 root root    687 Feb  3 07:16 networkinterface2.html
-rwxr-xr-x 1 root root  13564 Feb  3 07:16 networkresource
-rwxr-xr-x 1 root root   1413 Feb  3 07:16 networkresource1.html
-rwxr-xr-x 1 root root    262 Feb  3 07:16 networkresource2.html
-rwxr-xr-x 1 root root   2258 Feb  3 07:16 newLoginWindow.html
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 newcsr
-rwxr-xr-x 1 root root   7639 Feb  3 07:16 newcsr.html
-rwxr-xr-x 1 root root   2250 Feb  3 07:16 noPluginSupport.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 nph-httprp
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 nxpolicy.xml
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 onlineHelp
-rwxr-xr-x 1 root root  38136 Feb  3 07:16 otp
-rwxr-xr-x 1 root root   1549 Feb  3 07:16 otp1.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 otpError
-rwxr-xr-x 1 root root    941 Feb  3 07:16 otpError1.html
-rwxr-xr-x 1 root root     47 Feb  3 07:16 otpError2.html
-rwxr-xr-x 1 root root  42232 Feb  3 07:16 otpLogin
-rwxr-xr-x 1 root root   1582 Feb  3 07:16 otpsms.html
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 outlookView
-rwxr-xr-x 1 root root  33360 Feb  3 07:16 outlookView.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 policies
-rwxr-xr-x 1 root root   2926 Feb  3 07:16 policies1.html
-rwxr-xr-x 1 root root    411 Feb  3 07:16 policies2.html
-rwxr-xr-x 1 root root  30472 Feb  3 07:16 policyMatchedLog
-rwxr-xr-x 1 root root  14230 Feb  3 07:16 policyMatchedLog1.html
-rwxr-xr-x 1 root root    587 Feb  3 07:16 policyMatchedLog2.html
-rwxr-xr-x 1 root root  25848 Feb  3 07:16 portal
-rwxr-xr-x 1 root root  10190 Feb  3 07:16 portal1.html
-rwxr-xr-x 1 root root   1644 Feb  3 07:16 portalMobile.html
-rwsr-sr-x 1 root root  25848 Feb  3 07:16 portalWizard
-rwxr-xr-x 1 root root  23330 Feb  3 07:16 portalWizard.html
-rwxr-xr-x 1 root root  13576 Feb  3 07:16 portallist
-rwxr-xr-x 1 root root   6152 Feb  3 07:16 portallist1.html
-rwxr-xr-x 1 root root  19279 Feb  3 07:16 portalv2.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 portalvaiprules
-rwxr-xr-x 1 root root   6772 Feb  3 07:16 portalvaiprules.html
-rwxr-xr-x 1 root root  13360 Feb  3 07:16 postconnectionscripts.fragment.html
-rwxr-xr-x 1 root root   1074 Feb  3 06:55 printenv.vbs
-rwxr-xr-x 1 root root   1133 Feb  3 06:55 printenv.wsf
-rwxr-xr-x 1 root root   2738 Feb  3 07:16 protectedmode.html
-rwxr-xr-x 1 root root   1186 Feb  3 07:16 radiusChallenge.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 radiusChallengeLogin
-rwxr-xr-x 1 root root   8131 Feb  3 07:16 rdpLogin.html
-rwxr-xr-x 1 root root   8624 Feb  3 07:16 rdp_client.html
-rwxr-xr-x 1 root root   1133 Feb  3 07:16 reboot.html
-rwxr-xr-x 1 root root  42232 Feb  3 07:16 registerDevice
-rwxr-xr-x 1 root root   1214 Feb  3 07:16 registerDevice.html
-rwsr-sr-x 1 root root  34824 Feb  3 07:16 restart
-rwxr-xr-x 1 root root   1867 Feb  3 07:16 restart.html
-rwxr-xr-x 1 root root  17656 Feb  3 07:16 rsaLogin
-rwxr-xr-x 1 root root   1150 Feb  3 07:16 rsaNewPIN.html
-rwxr-xr-x 1 root root    977 Feb  3 07:16 rsaNextCode.html
-rwxr-xr-x 1 root root   1171 Feb  3 07:16 rsaSysPin.html
-rwsr-sr-x 1 root root  21808 Feb  3 07:16 serviceSettings
-rwxr-xr-x 1 root root  33398 Feb  3 07:16 serviceSettings.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 sessionStatus
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 setCommonName
-rwsr-sr-x 1 root root  63592 Feb  3 07:16 settings
-rwxr-xr-x 1 root root  21388 Feb  3 07:16 settings1.html
-rwxr-xr-x 1 root root   8850 Feb  3 07:16 settings2.html
-rwxr-xr-x 1 root root   2023 Feb  3 07:16 settings3.html
-rwxr-xr-x 1 root root  38136 Feb  3 07:16 showDeviceProfile
-rwxr-xr-x 1 root root  82872 Feb  3 07:16 showDeviceProfile1.html
-rwxr-xr-x 1 root root  32147 Feb  3 07:16 showDeviceProfile2.html
-rwxr-xr-x 1 root root    682 Feb  3 07:16 showDeviceProfile3.html
-rwxr-xr-x 1 root root  25848 Feb  3 07:16 showPolicy
-rwxr-xr-x 1 root root   6131 Feb  3 07:16 showPolicy1.html
-rwxr-xr-x 1 root root   1394 Feb  3 07:16 siteBlocked.html
-rwsr-sr-x 1 root root  46328 Feb  3 07:16 sitecustomization
-rwxr-xr-x 1 root root  87505 Feb  3 07:16 sitecustomization1.html
-rwxr-xr-x 1 root root  84396 Feb  3 07:16 sitecustomization2.html
-rwxr-xr-x 1 root root   9516 Feb  3 07:16 smsTemplates
-rwxr-xr-x 1 root root   3592 Feb  3 07:16 smsTemplates.html
-rwxr-xr-x 1 root root  83252 Feb  3 07:16 sonicfiles
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 soniclauncher
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 ssh
-rwxr-xr-x 1 root root   1717 Feb  3 07:16 sshHtml.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 sshv2
-rwsr-sr-x 1 root root  21752 Feb  3 07:16 sslcert
-rwxr-xr-x 1 root root   4737 Feb  3 07:16 sslcert1.html
-rwxr-xr-x 1 root root   1083 Feb  3 07:16 sslcert2.html
-rwxr-xr-x 1 root root   4033 Feb  3 07:16 sslcert3.html
-rwxr-xr-x 1 root root  62712 Feb  3 07:16 sslvpnclient
-rwxr-xr-x 1 root root    112 Feb  3 07:16 sslvpnclient1.html
-rwxr-xr-x 1 root root   1259 Feb  3 07:16 sslvpnclient2.html
-rwxr-xr-x 1 root root   2034 Feb  3 07:16 sslvpnclient3.html
-rwxr-xr-x 1 root root    393 Feb  3 07:16 sslvpnclient4.html
-rwxr-xr-x 1 root root  13612 Feb  3 07:16 sslvpnclientforaov
-rwxr-xr-x 1 root root   2491 Feb  3 07:16 sslvpnclientmac1.html
-rwxr-xr-x 1 root root    558 Feb  3 07:16 sslvpnpassage.html
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 staticContent
-rwxr-xr-x 1 root root  17656 Feb  3 07:16 staticroutes
-rwxr-xr-x 1 root root   3221 Feb  3 07:16 staticroutes1.html
-rwxr-xr-x 1 root root   1057 Feb  3 07:16 staticroutes2.html
-rwxr-xr-x 1 root root    411 Feb  3 07:16 staticroutes3.html
-rwsr-sr-x 1 root root  25848 Feb  3 07:16 status
-rwsr-sr-x 1 root root  18184 Feb  3 07:16 status.xml
-rwxr-xr-x 1 root root   3706 Feb  3 07:16 status1.html
-rwxr-xr-x 1 root root  16415 Feb  3 07:16 status2.html
-rwxr-xr-x 1 root root   5368 Feb  3 07:16 statusBar
-rwxr-xr-x 1 root root    411 Feb  3 07:16 statusBar.html
-rwxr-xr-x 1 root root  37688 Feb  3 07:16 sw_httprp.js
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 telnet
-rwxr-xr-x 1 root root   1530 Feb  3 07:16 telnetHtml.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 totp
-rwxr-xr-x 1 root root   2937 Feb  3 07:16 totp1.html
-rwxr-xr-x 1 root root  42236 Feb  3 07:16 tscbookmark
-rwxr-xr-x 1 root root  17656 Feb  3 07:16 ubaGroup
-rwxr-xr-x 1 root root   9253 Feb  3 07:16 ubaGroup.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 ubaMain
-rwxr-xr-x 1 root root   3324 Feb  3 07:16 ubaMain.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 ubaMember
-rwxr-xr-x 1 root root   6263 Feb  3 07:16 ubaMember.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 ubaNavigationPage
-rwxr-xr-x 1 root root    864 Feb  3 07:16 ubaNavigationPageHeader.html
-rwsr-sr-x 1 root root  34824 Feb  3 07:16 upgradefirmware
-rwxr-xr-x 1 root root   3034 Feb  3 07:16 upgradefirmware.html
-rwsr-sr-x 1 root root   5368 Feb  3 07:16 upgraderom
-rwxr-xr-x 1 root root   2296 Feb  3 07:16 upgraderom.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 upload
-rwxr-xr-x 1 root root 107768 Feb  3 07:16 userLogin
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 userLogout
-rwxr-xr-x 1 root root  17656 Feb  3 07:16 userOptions
-rwxr-xr-x 1 root root  10386 Feb  3 07:16 userOptions1.html
-rwxr-xr-x 1 root root  21752 Feb  3 07:16 users
-rwxr-xr-x 1 root root   3358 Feb  3 07:16 users1.html
-rwxr-xr-x 1 root root    754 Feb  3 07:16 users2.html
-rwsr-sr-x 1 root root  17656 Feb  3 07:16 viewcacert
-rwxr-xr-x 1 root root   5617 Feb  3 07:16 viewcacert1.html
-rwsr-sr-x 1 root root  13560 Feb  3 07:16 viewcert
-rwxr-xr-x 1 root root   6578 Feb  3 07:16 viewcert1.html
-rwxr-xr-x 1 root root     24 Feb  3 07:16 viewcert2.html
-rwxr-xr-x 1 root root  18184 Feb  3 07:16 viewpoint
-rwxr-xr-x 1 root root   3579 Feb  3 07:16 viewpoint1.html
-rwxr-xr-x 1 root root   3079 Feb  3 07:16 viewpoint2.html
-rwxr-xr-x 1 root root   2071 Feb  3 07:16 viewpoint3.html
-rwxr-xr-x 1 root root   2449 Feb  3 07:16 viewsamlcert1.html
-rwxr-xr-x 1 root root   3295 Feb  3 07:16 virtualAssistPlugIn.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 vnc
-rwxr-xr-x 1 root root   5250 Feb  3 07:16 vnc.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 wafLicense
-rwxr-xr-x 1 root root   2950 Feb  3 07:16 wafLicense.html
-rwxr-xr-x 1 root root  38276 Feb  3 07:16 wafMonitoring
-rwxr-xr-x 1 root root  56614 Feb  3 07:16 wafMonitoring.html
-rwxr-xr-x 1 root root  46736 Feb  3 07:16 wafPDFReport
-rwxr-xr-x 1 root root   9421 Feb  3 07:16 wafPDFReport.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 wafRule
-rwxr-xr-x 1 root root  45075 Feb  3 07:16 wafRule.html
-rwxr-xr-x 1 root root  17656 Feb  3 07:16 wafRuleChain
-rwxr-xr-x 1 root root  12609 Feb  3 07:16 wafRuleChain.html
-rwxr-xr-x 1 root root  38140 Feb  3 07:16 wafRuleChainList
-rwxr-xr-x 1 root root  41502 Feb  3 07:16 wafRuleChainList.html
-rwxr-xr-x 1 root root  17656 Feb  3 07:16 wafSignatures
-rwxr-xr-x 1 root root  15467 Feb  3 07:16 wafSignatures.html
-rwxr-xr-x 1 root root  13560 Feb  3 07:16 wafStatus
-rwxr-xr-x 1 root root   4244 Feb  3 07:16 wafStatus.html
-rwxr-xr-x 1 root root  38136 Feb  3 07:16 wafSummary
-rwxr-xr-x 1 root root  79921 Feb  3 07:16 wafSummary.html
-rwxr-xr-x 1 root root   9464 Feb  3 07:16 wafURLProfile
-rwxr-xr-x 1 root root   8404 Feb  3 07:16 wafURLProfile.html
-rwxr-xr-x 1 root root  30480 Feb  3 07:16 welcome
root@sslvpn:/usr/src/EasyAccess/www/cgi-bin #

Web path /spog also contains binaries used by the web interface. Any binaries using the SQLite backend are potentially vulnerable to SQL injection. Rapid7 researchers noted that some endpoints were protected against trivial SQL injection, though the surface area for attack is still considerable.

Furthermore, Rapid7 researchers noticed a Python-based authentication API reverse-proxied from web path /__api__ to the service listening on 127.0.0.1:12345.

root@sslvpn:/usr/src/EasyAccess/www/python/authentication_api # ls -l
total 27
drwxr-xr-x 2 root root 1024 Feb  3 22:08 __pycache__
drwxr-xr-x 6 root root 1024 Feb  3 22:08 authentication
-r--r--r-- 1 root root 1092 Feb  3 07:16 authentication_api.py
-r--r--r-- 1 root root 1678 Feb  3 07:16 c_macros.py
drwxr-xr-x 4 root root 3072 Feb  3 22:08 management
-r--r--r-- 1 root root  461 Feb  3 07:16 management_api.py
drwxr-xr-x 4 root root 1024 Feb  3 22:08 report
-r--r--r-- 1 root root  457 Feb  3 07:16 report_api.py
-r--r--r-- 1 root root 2621 Feb  3 07:16 restful_api.py
drwxr-xr-x 3 root root 1024 Feb  3 07:16 threat
-r--r--r-- 1 root root  454 Feb  3 07:16 threat_api.py
root@sslvpn:/usr/src/EasyAccess/www/python/authentication_api #

root@sslvpn:/usr/src/EasyAccess/www/python/authentication_api # lsof -nPi :12345
COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
python3.6 1364 root    8u  IPv4    869      0t0  TCP 127.0.0.1:12345 (LISTEN)
root@sslvpn:/usr/src/EasyAccess/www/python/authentication_api #

This service could also be susceptible to injection attacks through the web interface.

Guidance

SonicWall SMA 100 series 10.x customers should upgrade their firmware to version 10.2.0.5-29sv. Though mitigations are available in the form of enabling MFA and/or the WAF, patching should remain the utmost priority for organizations affected by CVE-2021-20016.

Very High