Vulnerability · Published May 4, 2022 · Assigned by sonicwall
CVE-2021-20051
High 7.8
In plain English
A high-severity uncontrolled search path in SonicWall Global VPN Client from SonicWall. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.7%top 45.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SonicWall Global VPN Client 4.10.7.1117 installer (32-bit and 64-bit) and earlier versions have a DLL Search Order Hijacking vulnerability in one of the installer components. Successful exploitation via a local attacker could result in command execution in the target system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SonicWall | SonicWall Global VPN Client | Global VPN Client 4.10.7.1117 and earlier versions |
Weakness: CWE-427
References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0036 x_refsource_CONFIRM