Skip to main content

Netextender CVE-2023-44220

HIGH
Uncontrolled Search Path Element (CWE-427)
2023-10-27 PSIRT@sonicwall.com
Information Disclosure Microsoft Sonicwall Netextender
7.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.3 HIGH
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Oct 27, 2023 - 08:15 nvd
HIGH 7.3

DescriptionNVD

SonicWall NetExtender Windows (32-bit and 64-bit) client 10.2.336 and earlier versions have a DLL Search Order Hijacking vulnerability in the start-up DLL component. Successful exploitation via a local attacker could result in command execution in the target system.

AnalysisAI

SonicWall NetExtender Windows (32-bit and 64-bit) client 10.2.336 and earlier versions have a DLL Search Order Hijacking vulnerability in the start-up DLL component. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-427. SonicWall NetExtender Windows (32-bit and 64-bit) client 10.2.336 and earlier versions have a DLL Search Order Hijacking vulnerability in the start-up DLL component. Successful exploitation via a local attacker could result in command execution in the target system. Affected products include: Sonicwall Netextender.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Netextender

View all
CVE-2024-29014 HIGH
8.8 Jul 18

Vulnerability in SonicWall SMA100 NetExtender Windows (32 and 64-bit) client 10.2.339 and earlier versions allows an att
CVE-2023-44218 HIGH
7.8 Oct 03

A flaw within the SonicWall NetExtender Pre-Logon feature enables an unauthorized user to gain access to the host Window
CVE-2023-44217 HIGH
7.8 Oct 03

A local privilege escalation vulnerability in SonicWall Net Extender MSI client for Windows 10.2.336 and earlier version
CVE-2022-22281 HIGH
7.8 May 13

A buffer overflow vulnerability in the SonicWall SSL-VPN NetExtender Windows Client (32 and 64 bit) in 10.2.322 and earl
CVE-2020-5131 HIGH
7.8 Jul 17

SonicWall NetExtender Windows client vulnerable to arbitrary file write vulnerability, this allows attacker to overwrite
CVE-2015-4173 MEDIUM
6.9 Aug 26

Unquoted Windows search path vulnerability in the autorun value in Dell SonicWall NetExtender before 7.5.227 and 8.0.x b

Same weakness CWE-427 – Uncontrolled Search Path Element

View all
CVE-2017-6517 CRITICAL POC
9.8
CVE-2020-27955 CRITICAL POC
9.8
CVE-2024-48990 HIGH POC
7.8
CVE-2020-3433 HIGH POC
7.8
CVE-2022-2334 HIGH POC
7.2
CVE-2024-23054 CRITICAL POC
9.8
CVE-2023-31543 CRITICAL POC
9.8
CVE-2019-7653 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2023-44220 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy