SonicWall · SMA 100 Appliances
CVE-2021-20038
SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability
Cos'è
A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.
CISA: SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.
Cosa fare
Apply updates per vendor instructions.
Scadenza per le agenzie federali USA: 11 febbraio 2022
Altre falle sfruttate di SonicWall
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 2 set 2026 | Server-Side Request Forgery | SMA1000 Appliances | Critica 10,0 | 8,0% |
| 2 set 2026 | OS Command Injection | SMA1000 Appliances | Alta 7,8 | 9,9% |
| 14 lug 2026 | Server-Side Request Forgery | SMA1000 Appliances | Critica 10,0 | 6,8% |
| 14 lug 2026 | Code Injection | SMA1000 Appliances | Alta 7,2 | 12% |
| 17 dic 2025 | SMA1000 Missing Authorization | SMA1000 appliance | Media 6,6 | 2,8% |
| 1 mag 2025 | OS Command Injection | SMA100 Appliances | Alta 7,2 | 76% |
| 16 apr 2025 | OS Command Injection | SMA100 Appliances | Media 6,5 | 4,4% |
| 18 feb 2025 | SSLVPN Improper Authentication | SonicOS | Alta 8,2 | 95% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.