Actively exploited · Published Sep 27, 2021 · Assigned by sonicwall
CVE-2021-20035
Medium 6.5 Exploited
In plain English
A medium-severity OS command injection in SMA100 from SonicWall. Attackers are actively exploiting it in the wild (listed by CISA on April 16, 2025). The chance it is exploited in the next 30 days is estimated at 4.4% (higher than 91% of all known vulnerabilities). Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by May 7, 2025.
Official description
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022 x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20035 government-resource