Security researchers from NCC Group have identified critical vulnerabilities that affect SonicWall’s Secure Mobile Access (SMA) 100-series VPN appliances. The most severe of the vulnerabilities is a single stack-based buffer overflow that, if exploited, could allow an unauthenticated attacker to perform remote code execution (RCE) as the root user, leading to a complete appliance takeover. There is not yet any evidence that these vulnerabilities have been exploited in-the-wild. This is the third time this year that vulnerabilities affecting SonicWall SMA 100-series appliances have been identified. In March they were targeted by the Mirai botnet, and in July they were potential victims of a ransomware campaign facilitated by using stolen credentials. The patch for this current set of vulnerabilities is currently unavailable and a spokesperson from the vendor stated that patching should be on the agenda. The Ankura CTAPT will continue to stay on top of this matter, and will release an update when an official patch is published.