PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9684 Dell CVE debrief

CVE-2016-9684 is a critical network-reachable command injection issue in the SonicWall Secure Remote Access web administrative interface. The affected viewcert CGI component (/cgi-bin/viewcert) fails to properly escape the CERT value before calling system(), which can allow remote command execution. The supplied description notes that successful exploitation can yield shell access as the nobody user.

Vendor
Dell
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-22
Original CVE updated
2026-05-13
Advisory published
2017-02-22
Advisory updated
2026-05-13

Who should care

Administrators and security teams responsible for SonicWall Secure Remote Access / SMA 100-series appliances, especially systems exposing the web administration interface to untrusted networks. Incident responders should also pay attention if these appliances were reachable during the vulnerable period.

Technical summary

NVD lists the vulnerable product as SonicWall Secure Remote Access Server 8.1.0.2-14sv and classifies the weakness as CWE-77 (Command Injection). The CVSS 3.0 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating unauthenticated remote exploitation over the network. The vulnerable path is /cgi-bin/viewcert, where unescaped CERT input reaches system(), enabling command injection.

Defensive priority

Urgent

Recommended defensive actions

  • Identify any SonicWall Secure Remote Access / SMA appliances running the vulnerable 8.1.0.2-14sv build or otherwise matching the affected advisory.
  • Apply the vendor remediation referenced by SonicWall PSIRT and the 8.1.0.7 release notes as soon as possible.
  • Restrict exposure of the web administration interface to trusted management networks only until affected systems are patched.
  • Review appliance and web-access logs for unexpected activity involving /cgi-bin/viewcert or unusual administrative requests.
  • If compromise is suspected, isolate the appliance, preserve logs and configuration data, and rotate credentials and any exposed secrets after containment.

Evidence notes

The supplied NVD record shows CVE publication on 2017-02-22 and a later metadata modification on 2026-05-13. NVD identifies the affected CPE as cpe:2.3:o:dell:sonicwall_secure_remote_access_server:8.1.0.2-14sv:*:*:*:*:*:*:* and assigns CVSS 3.0 9.8 with CWE-77. The NVD references include SonicWall PSIRT advisory SNWLID-2016-0005 and the Dell/SonicWall 8.1.0.7 resolved-issues release notes, which together support the vendor-fix context.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9684 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9684

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9684 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9684

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.