---
cve: "CVE-2023-34127"
severity: "HIGH"
cvss: 8.8
epss: "86.5%"
vendor: "SonicWall"
kev: false
exploited: false
published: "2023-07-13 01:15:08"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-16T20:42:49+02:00"
---

# CVE-2023-34127

> 8.8 HIGH · 🧪 PoC

## Beschreibung

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analytics enables an authenticated attacker to execute arbitrary code with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Referenzen

- <https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010>
- <https://www.sonicwall.com/support/notices/230710150218060>
- <http://packetstormsecurity.com/files/174571/Sonicwall-GMS-9.9.9320-Remote-Code-Execution.html>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2023-34127) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_