EXPLOIT
This flaws were being exploited by use of the following CVEs
CVE-2023-44221 (CVSS score: 7.2) – Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a ‘nobody’ user, potentially leading to OS Command Injection Vulnerability
CVE-2024-38475 (CVSS score: 9.8) – Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to file system locations that are permitted to be served by the server
RECOMENDATION
Both the flaws affect SMA 100 Series devices, including SMA 200, 210, 400, 410, 500v, and were addressed in the following versions –
CVE-2023-44221 – 10.2.1.10-62sv and higher versions (Fixed on December 4, 2023)
CVE-2024-38475 – 10.2.1.14-75sv and higher versions (Fixed on December 4, 2024)
MWCERT recommends users of Appache HTTP Webserver Implement Patches or update to version 2.4.60