CVE-2021-20035
medium · 6.5Actively exploitedOn the CISA Known Exploited Vulnerabilities catalog
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Added 2025-04-16Remediation due 2025-05-07
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.
6.5
CVSS
4.2%
EPSS (exploit prob.)
90th
EPSS percentile
2021-09-27
Published
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-78
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| sonicwall | sma_200_firmware | < 9.0.0.11-31sv |
| sonicwall | sma_200_firmware | >= 10.2.0.0, < 10.2.0.8-37sv |
| sonicwall | sma_200_firmware | >= 10.2.1.0, < 10.2.1.1-19sv |
| sonicwall | sma_200 | all versions |
| sonicwall | sma_210_firmware | < 9.0.0.11-31sv |
| sonicwall | sma_210_firmware | >= 10.2.0.0, < 10.2.0.8-37sv |
| sonicwall | sma_210_firmware | >= 10.2.1.0, < 10.2.1.1-19sv |
| sonicwall | sma_210 | all versions |
| sonicwall | sma_400_firmware | < 9.0.0.11-31sv |
| sonicwall | sma_400_firmware | >= 10.2.0.0, < 10.2.0.8-37sv |
| sonicwall | sma_400_firmware | >= 10.2.1.0, < 10.2.1.1-19sv |
| sonicwall | sma_400 | all versions |
| sonicwall | sma_410_firmware | < 9.0.0.11-31sv |
| sonicwall | sma_410_firmware | >= 10.2.0.0, < 10.2.0.8-37sv |
| sonicwall | sma_410_firmware | >= 10.2.1.0, < 10.2.1.1-19sv |
| sonicwall | sma_410 | all versions |
| sonicwall | sma_500v | < 9.0.0.11-31sv |
| sonicwall | sma_500v | >= 10.2.0.0, < 10.2.0.8-37sv |
| sonicwall | sma_500v | >= 10.2.1.0, < 10.2.1.1-19sv |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2021-20035