SonicWall · SMA100 Appliances

CVE-2021-20035

SonicWall SMA100 Appliances OS Command Injection Vulnerability

Exploited in attacks Medium 6.5 Attack chance: 4.4%

What it is

Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.

CISA: SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: May 7, 2025

Added to the CISA list: April 16, 2025
Published: September 27, 2021
Severity: Medium 6.5 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 4.4% in the top 8.7% of all known vulnerabilities
Weakness: CWE-78
More details: NVD · CVE.org · CISA

All references (1)

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022

More exploited flaws from SonicWall

Added	Vulnerability	Product	Severity	Attack chance
May 1, 2025	OS Command InjectionCVE-2023-44221	SMA100 Appliances	High 7.2	76%
Sep 2, 2026	Server-Side Request ForgeryCVE-2026-83548	SMA1000 Appliances	Critical 10.0	8.0%
Sep 2, 2026	OS Command InjectionCVE-2026-83549	SMA1000 Appliances	High 7.8	9.9%
Jul 14, 2026	Server-Side Request ForgeryCVE-2026-15409used by ransomware	SMA1000 Appliances	Critical 10.0	6.8%
Jul 14, 2026	Code InjectionCVE-2026-15410used by ransomware	SMA1000 Appliances	High 7.2	12%
Dec 17, 2025	SMA1000 Missing AuthorizationCVE-2025-40602	SMA1000 appliance	Medium 6.6	2.8%
Feb 18, 2025	SSLVPN Improper AuthenticationCVE-2024-53704used by ransomware	SonicOS	High 8.2	95%
Jan 24, 2025	DeserializationCVE-2025-23006used by ransomware	SMA1000 Appliances	Critical 9.8	23%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.