CVE-2021-20038

SonicWall SMA100

Published 8 Dec 2021 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 28 Jan 2022, with a remediation deadline of 11 Feb 2022 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.

References

github.com/jbaines-r7/badblood · Exploit, Third Party Advisory
psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026 · Vendor Advisory
www.rapid7.com/blog/post/2022/01/11/cve-2021-20038-42-sonicwall-sma-100-multiple-vulnerabilities-fixed-2/ · Exploit, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20038 · US Government Resource