CVE-2023-41109: Patton SmartNode SN200 unauthenticated OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityUnauthenticated remote OS command injection with CVSS 9.8 and high EPSS on an internet-reachable device makes this an urgent patch target.

What it is

SmartNode SN200 firmware 3.21.2-23021 contains an OS command injection flaw (CWE-78) reachable without authentication. A remote attacker can execute arbitrary operating system commands on the device, which is a critical risk for an internet-facing VoIP gateway.

Impact

An attacker gains arbitrary command execution with the privileges of the vulnerable service, allowing full compromise of the device's confidentiality, integrity and availability. This can lead to configuration theft, call interception or use of the device as a pivot into the network.

Attack surface

The CVSS vector AV:N/AC:L/PR:N/UI:N indicates the flaw is reachable over the network with no authentication and no user interaction. The description does not identify the specific vulnerable endpoint or parameter.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.6451 (99.2nd percentile) and a public advisory is tagged Exploit, indicating exploit code is publicly available and exploitation is likely.

What to do

• Upgrade SmartNode SN200 firmware beyond 3.21.2-23021 to a vendor-fixed release; confirm the fixed version with Patton since the record does not state one.
• Remove direct internet exposure of the SN200 management and service interfaces; restrict access to trusted management networks.
• Segment VoIP and gateway devices from general user and server networks to limit lateral movement after compromise.
• Monitor Patton advisories and the SYSS-2023-019 advisory for updated remediation guidance.
• If patching is not immediately possible, apply strict firewall rules and authentication proxies in front of the device.

Detection

• Alert on unexpected outbound connections or command-shell-like traffic originating from SN200 devices.
• Monitor device logs and syslog for abnormal process execution, reboots or configuration changes.
• Use network IDS signatures for command injection patterns targeting the SN200 web or service interfaces.
• Baseline normal SN200 traffic and flag new source IPs or unusual request payloads to its management ports.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.