CVE-2021-20035: Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary co

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• sonicwall sma 200 firmwarebefore 9.0.0.11-31sv
• sonicwall sma 200 firmware10.2.0.0 and later · before 10.2.0.8-37sv
• sonicwall sma 200 firmware10.2.1.0 and later · before 10.2.1.1-19sv
• sonicwall sma 210 firmwarebefore 9.0.0.11-31sv
• sonicwall sma 210 firmware10.2.0.0 and later · before 10.2.0.8-37sv
• sonicwall sma 210 firmware10.2.1.0 and later · before 10.2.1.1-19sv
• sonicwall sma 400 firmwarebefore 9.0.0.11-31sv
• sonicwall sma 400 firmware10.2.0.0 and later · before 10.2.0.8-37sv
• sonicwall sma 400 firmware10.2.1.0 and later · before 10.2.1.1-19sv
• sonicwall sma 410 firmwarebefore 9.0.0.11-31sv
• sonicwall sma 410 firmware10.2.0.0 and later · before 10.2.0.8-37sv
• sonicwall sma 410 firmware10.2.1.0 and later · before 10.2.1.1-19sv
• sonicwall sma 500vbefore 9.0.0.11-31sv
• sonicwall sma 500v10.2.0.0 and later · before 10.2.0.8-37sv
• sonicwall sma 500v10.2.1.0 and later · before 10.2.1.1-19sv

Versions reported by the vendor

Affected version ranges reported by the assigning authority (sonicwall). Independent of NVD's CPE analysis and usually ahead of it.

• SonicWall SMA100

  • 9.0.0.10-28sv and earlier, 10.2.0.7-34sv and earlier, 10.2.1.0-17sv and earlieraffected

Other highest-scoring records for the same primary product.

• CVE-2021-20038A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticKEV
  99Now
• CVE-2023-44221Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrKEV
  81Now
• CVE-2021-20034An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete a
  61This week

Published before and after this one in the same product

• Later →CVE-2021-20039Dec 8, 2021 · Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenti
  59Plan
• Later →CVE-2021-20040Dec 8, 2021 · A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages or
  38Monitor
• Later →CVE-2021-20041Dec 8, 2021 · An unauthenticated and remote adversary can consume all of the device's CPU due to crafted HTTP requests sent to SMA100 /fileshare/sonicfile
  36Monitor

Root cause

User input is inserted as text into a shell command. The shell may interpret special characters in the input as part of the command.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const host = req.body.host;2exec("ping -c 1 " + host, onResult);

1const host = req.body.host;2if (!/^[a-z0-9.-]{1,253}$/i.test(host)) return res.sendStatus(400);3execFile("ping", ["-c", "1", host], onResult);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.