CVE-2023-34127: SonicWall GMS and Analytics OS command injection to root

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 8.8 with root-level code execution and a very high EPSS score, though it requires authenticated access and is not in KEV.

What it is

SonicWall GMS and Analytics contain an OS command injection flaw (CWE-78) that lets an authenticated attacker run arbitrary commands with root privileges. The affected versions are GMS 9.3.2-SP1 and earlier and Analytics 2.5.0.4-R7 and earlier. Because the resulting code runs as root, a single authenticated foothold can fully compromise the appliance.

Impact

An attacker with valid credentials gains arbitrary code execution as root on the GMS or Analytics host, allowing full control of the system, its data and any managed devices or credentials it holds.

Attack surface

The vulnerability is network-reachable (AV:N) and requires low-privileged authentication (PR:L) with no user interaction (UI:N). It is reached through the GMS or Analytics web interface by a logged-in user.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is very high at 0.865 (99.7th percentile), and a public Packet Storm remote code execution write-up exists, indicating exploit interest and likely availability.

What to do

• Upgrade GMS to a version later than 9.3.2-SP1 and Analytics to a version later than 2.5.0.4-R7 per the SonicWall PSIRT advisory SNWLID-2023-0010.
• Restrict network access to GMS and Analytics management interfaces to trusted administrative networks only.
• Enforce least privilege and strong authentication for GMS/Analytics accounts, and audit for unnecessary or shared logins.
• Monitor and rotate any credentials or device secrets stored or managed by the affected appliances.
• If immediate patching is not possible, isolate the appliance and apply compensating network controls until upgrade.

Detection

• Review GMS/Analytics logs and web server logs for suspicious command or shell metacharacter patterns in requests from authenticated sessions.
• Monitor for unexpected child processes spawned by the GMS/Analytics web service, especially shells or commands running as root.
• Alert on anomalous outbound network connections or file writes originating from the GMS/Analytics host.
• Audit authentication logs for unusual or off-hours logins to GMS/Analytics administrative accounts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.