CVE-2021-20038criticalunder attackransomwareCWE-121

CVE-2021-20038: critical vulnerability in SonicWall SMA100

Published · Updated

Follow this CVE+ Monitor SMA100+ Monitor SMA100 Appliances

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon34 days
Published on NVDDec 8
1st PoC+34d
CISA KEV+51d
Action required by CISAfederal deadline: 2022-02-11

Apply updates per vendor instructions.

In short

A flaw in the web server of SMA100 appliances allows attackers to send specially crafted requests that overflow a memory buffer, potentially letting them run malicious code on the device without needing a password.

Technical detail

Stack-based buffer overflow in mod_cgi module's environment variable handling permits unauthenticated remote code execution with 'nobody' user privileges on affected SMA appliances (200, 210, 400, 410, 500v). Attack vector is network-based via HTTP requests; no authentication required.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
SonicWall · SonicWall SMA100
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SonicWall SMA100

In the same product, most dangerous first.

CVE-2021-20016CRITICALCVE-2021-20016EPSS 40.0%KEVCVE-2021-20039HIGHCVE-2021-20039EPSS 78.7%CVE-2021-20044—CVE-2021-20044EPSS 40.1%CVE-2021-20045—CVE-2021-20045EPSS 25.2%CVE-2021-20040—CVE-2021-20040EPSS 25.1%CVE-2021-20043—CVE-2021-20043EPSS 23.3%