FKIE_CVE-2021-20035

Vulnerability from fkie_nvd - Published: 2021-09-27 18:15 - Updated: 2026-06-17 03:33
Severity
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.
References
PSIRT@sonicwall.comhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20035US Government Resource
Impacted products
Vendor Product Version
sonicwall sma_200_firmware *
sonicwall sma_200_firmware *
sonicwall sma_200_firmware *
sonicwall sma_200 -
sonicwall sma_210_firmware *
sonicwall sma_210_firmware *
sonicwall sma_210_firmware *
sonicwall sma_210 -
sonicwall sma_400_firmware *
sonicwall sma_400_firmware *
sonicwall sma_400_firmware *
sonicwall sma_400 -
sonicwall sma_410_firmware *
sonicwall sma_410_firmware *
sonicwall sma_410_firmware *
sonicwall sma_410 -
sonicwall sma_500v *
sonicwall sma_500v *
sonicwall sma_500v *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "SMA100",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.0.10-28sv and earlier"
            },
            {
              "status": "affected",
              "version": "10.2.0.7-34sv and earlier"
            },
            {
              "status": "affected",
              "version": "10.2.1.0-17sv and earlier"
            }
          ]
        }
      ],
      "source": "PSIRT@sonicwall.com"
    }
  ],
  "cisaActionDue": "2025-05-07",
  "cisaExploitAdd": "2025-04-16",
  "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "SonicWall SMA100 Appliances OS Command Injection Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1CAE16B5-709A-40E9-9C49-EA5DFA685299",
              "versionEndExcluding": "9.0.0.11-31sv",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2353D2AD-1943-4400-A7F9-884D38657CE4",
              "versionEndExcluding": "10.2.0.8-37sv",
              "versionStartIncluding": "10.2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A53E73ED-CE3D-4E81-BA96-5160CE726A96",
              "versionEndExcluding": "10.2.1.1-19sv",
              "versionStartIncluding": "10.2.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:sma_200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0B190266-AD6F-401B-9B2E-061CDD539236",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_210_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "47BFDA65-A16B-4983-9F7B-0B93DE953926",
              "versionEndExcluding": "9.0.0.11-31sv",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_210_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB4A2769-6449-4C24-8A4F-EE38A8CC32EC",
              "versionEndExcluding": "10.2.0.8-37sv",
              "versionStartIncluding": "10.2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_210_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "87C8D809-A71E-4C51-9F43-69C867E5E81F",
              "versionEndExcluding": "10.2.1.1-19sv",
              "versionStartIncluding": "10.2.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:sma_210:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "51587338-4A5F-41FC-9497-743F061947C2",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_400_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0B3EC70-4A0C-4281-80AC-1E004E1D5346",
              "versionEndExcluding": "9.0.0.11-31sv",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_400_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B45BCC41-D7F1-4242-8501-0E1AC2BD81A5",
              "versionEndExcluding": "10.2.0.8-37sv",
              "versionStartIncluding": "10.2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_400_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8BC841EE-6C00-402C-ACF4-CE4536EDFBCC",
              "versionEndExcluding": "10.2.1.1-19sv",
              "versionStartIncluding": "10.2.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:sma_400:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D728332-10C9-4508-B720-569D44E99543",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_410_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "999C0747-AFF2-4ABF-B8F0-A89202C1ACF4",
              "versionEndExcluding": "9.0.0.11-31sv",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_410_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A24369C9-53EE-4914-85DE-E95B8737CE8A",
              "versionEndExcluding": "10.2.0.8-37sv",
              "versionStartIncluding": "10.2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_410_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "34DA5394-545B-48ED-9971-7761AEC0278F",
              "versionEndExcluding": "10.2.1.1-19sv",
              "versionStartIncluding": "10.2.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:sma_410:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9DFB8FBC-FFA4-4526-B306-D5692A43DC9E",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sonicwall:sma_500v:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE6FE067-0B1A-4065-9218-7C6DD0D8A76E",
              "versionEndExcluding": "9.0.0.11-31sv",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sonicwall:sma_500v:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E86E27A1-5953-48C1-ACD0-3080AF643746",
              "versionEndExcluding": "10.2.0.8-37sv",
              "versionStartIncluding": "10.2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sonicwall:sma_500v:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "681CE4BD-C1F0-4737-88AE-3B555B85C33B",
              "versionEndExcluding": "10.2.1.1-19sv",
              "versionStartIncluding": "10.2.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a \u0027nobody\u0027 user which potentially leads to DoS."
    },
    {
      "lang": "es",
      "value": "Una neutralizaci\u00f3n inapropiada de los elementos especiales en la interfaz de administraci\u00f3n de SMA100 permite a un atacante remoto autenticado inyectar comandos arbitrarios como usuario \"nobody\", que conlleva potencialmente a un DoS"
    }
  ],
  "id": "CVE-2021-20035",
  "lastModified": "2026-06-17T03:33:11.067",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 6.8,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-20035",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-04-17T03:55:36.888408Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2021-09-27T18:15:08.383",
  "references": [
    {
      "source": "PSIRT@sonicwall.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20035"
    }
  ],
  "sourceIdentifier": "PSIRT@sonicwall.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "PSIRT@sonicwall.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.