PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9684 Dell CVE debrief

CVE-2016-9684 is a critical network-reachable command injection issue in the SonicWall Secure Remote Access web administrative interface. The affected viewcert CGI component (/cgi-bin/viewcert) fails to properly escape the CERT value before calling system(), which can allow remote command execution. The supplied description notes that successful exploitation can yield shell access as the nobody user.

Vendor
Dell
Product
CVE-2016-9684
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-22
Original CVE updated
2026-05-13
Advisory published
2017-02-22
Advisory updated
2026-05-13

Who should care

Administrators and security teams responsible for SonicWall Secure Remote Access / SMA 100-series appliances, especially systems exposing the web administration interface to untrusted networks. Incident responders should also pay attention if these appliances were reachable during the vulnerable period.

Technical summary

NVD lists the vulnerable product as SonicWall Secure Remote Access Server 8.1.0.2-14sv and classifies the weakness as CWE-77 (Command Injection). The CVSS 3.0 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating unauthenticated remote exploitation over the network. The vulnerable path is /cgi-bin/viewcert, where unescaped CERT input reaches system(), enabling command injection.

Defensive priority

Urgent

Recommended defensive actions

  • Identify any SonicWall Secure Remote Access / SMA appliances running the vulnerable 8.1.0.2-14sv build or otherwise matching the affected advisory.
  • Apply the vendor remediation referenced by SonicWall PSIRT and the 8.1.0.7 release notes as soon as possible.
  • Restrict exposure of the web administration interface to trusted management networks only until affected systems are patched.
  • Review appliance and web-access logs for unexpected activity involving /cgi-bin/viewcert or unusual administrative requests.
  • If compromise is suspected, isolate the appliance, preserve logs and configuration data, and rotate credentials and any exposed secrets after containment.

Evidence notes

The supplied NVD record shows CVE publication on 2017-02-22 and a later metadata modification on 2026-05-13. NVD identifies the affected CPE as cpe:2.3:o:dell:sonicwall_secure_remote_access_server:8.1.0.2-14sv:*:*:*:*:*:*:* and assigns CVSS 3.0 9.8 with CWE-77. The NVD references include SonicWall PSIRT advisory SNWLID-2016-0005 and the Dell/SonicWall 8.1.0.7 resolved-issues release notes, which together support the vendor-fix context.

Official resources

Publicly recorded in the supplied data on 2017-02-22 via NVD, with vendor advisory and release-notes references included in the record. No KEV listing is present in the supplied corpus.