FortiGuard Outbreak Alert: SonicWall Secure Mobile Access Attack

SonicWall SMA (Secure Mobile Access) is a secure remote access solution that allows users to access internal resources.

The Google Threat Intelligence Group (GTIG) has reported that threat actor UNC6148 is conducting an ongoing campaign targeting SonicWall SMA 100 series appliances.

Key component of this campaign was the deployment of OVERSTEP on the vulnerable application. OVERSTEP is a custom-rootkit which allows attacks to control and exfiltrate data from the appliance.

The following CVEs targeting SonicWall SMA 100 series appliances were observed during the campaign:

CVE-2025-32819 is a privilege-escalation vulnerability in SonicWall SMA 100 series appliances which allows a remote, authenticated user to delete files as root.

CVE-2024-38475 is a path-traversal vulnerability in Apache HTTP server which affects SonicWall SMA 100 series. This allows for unauthenticated users to perform remote file reads on the server.

CVE-2021-20038 is a buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables which could allow attackers to potentially execute code.

CVE-2021-20035 is a command injection vulnerability in SonicWall SMA 100 series appliance which allowed for authenticated attacker to inject command leading to Denial-of-Service attack.

CVE-2021-20039 is a command injection vulnerability in SonicWall SMA 100 series appliance which allowed for authenticated attacker to inject command to perform RCE attacks.

CVE ID    

NDR Cloud Detection Rule

Threat Hunting

Suricata Coverage

Customers can create custom investigation/detections using the Suricata signatures below:

2034984 -> ET EXPLOIT SonicWall SMA Stack-Based Buffer Overflow CVE-2021-20038 M1

2034985 -> ET EXPLOIT SonicWall SMA Stack-Based Buffer Overflow CVE-2021-20038 M2

2034986 -> ET EXPLOIT SonicWall SMA Authenticated Command Injection Attempt CVE-2021-20039

Other Fortinet Products