Zero-Day Vulnerability in SonicWall SMA 100 Series Version 10.x Products

Original release date: February 2, 2021 | Last revised: February 3, 2021

CISA is aware of a vulnerability in SonicWall Secure Mobile Access (SMA) 100 series products. SMA 100 series products provide an organization’s employees with remote access to internal resources. SonicWall security and engineering teams have confirmed a zero-day vulnerability that was reported by a third-party threat research team on Sunday, January 31, 2021. This vulnerability impacts only SMA 100 series devices with firmware version 10.x, and SonicWall has released a patch that should be applied immediately to avoid potential exploitation.  

CISA encourages users and administrators to review the SonicWall security advisory and apply the necessary update as soon as possible. CISA also encourages users and administrators to monitor the SonicWall advisory for updates as new information becomes available.

As a risk-reduction measure, CISA recommends organizations implement multi-factor authentication on all virtual private network connections.  

This product is provided subject to this Notification and this Privacy & Use policy.

Zero-Day Vulnerability in SonicWall SMA 100 Series Version 10.x Products

Original release date: February 2, 2021

CISA is aware of a vulnerability in SonicWall Secure Mobile Access (SMA) 100 series products. SMA 100 series products provide an organization’s employees with remote access to internal resources. SonicWall security and engineering teams have confirmed a zero-day vulnerability that was reported by a third-party threat research team on Sunday, January 31, 2021. This vulnerability impacts only SMA 100 series devices with firmware version 10.x, and SonicWall is working on a patch that is expected to be released by end of day Tuesday, February 2, 2021.  

Earlier reports about other zero-day vulnerabilities remain unconfirmed and are still under investigation.

CISA encourages users and administrators to review the SonicWall security advisory and apply the necessary mitigations and patches when they become available. CISA also encourages users and administrators to monitor the SonicWall advisory for updates as new information becomes available.

As a risk-reduction measure, CISA recommends organizations implement multi-factor authentication on all virtual private network connections.  

This product is provided subject to this Notification and this Privacy & Use policy.

Apple Releases Security Updates

Original release date: February 2, 2021

Apple has released security updates to address vulnerabilities in macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6. An attacker could exploit some of these vulnerabilities to take control of an affected system.

CISA encourages users and administrators to review the Apple security update and apply the necessary updates.

This product is provided subject to this Notification and this Privacy & Use policy.

Apple Releases Security Updates

Original release date: February 2, 2021

Apple has released security updates to address vulnerabilities in macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave 10.14.6. An attacker could exploit some of these vulnerabilities to take control of an affected system.

CISA encourages users and administrators to review the Apple security update and apply the necessary updates.

This product is provided subject to this Notification and this Privacy & Use policy.