CVE-2024-22395: SonicWall SMA 200 Firmware

Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a remote authenticated attacker to associate another user's MFA mobile application.

Affected products

• SonicWall SMA 200 Firmware: before 10.2.1.11-65sv (fixed in 10.2.1.11-65sv)
• SonicWall SMA 210 Firmware: before 10.2.1.11-65sv (fixed in 10.2.1.11-65sv)
• SonicWall SMA 400 Firmware: before 10.2.1.11-65sv (fixed in 10.2.1.11-65sv)
• SonicWall SMA 410 Firmware: before 10.2.1.11-65sv (fixed in 10.2.1.11-65sv)
• SonicWall SMA 500v Firmware: before 10.2.1.11-65sv (fixed in 10.2.1.11-65sv)

Published 2024-02-24. Last modified 2026-06-17.