{"id":"CVE-2021-20035","kind":"vulnerability","aliases":["CVE-2021-20035"],"related":[],"title":"Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated…","description":"SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"SonicWall SMA100 appliances have an OS command injection flaw in the management interface. A remote attacker with a valid login can run arbitrary commands on the appliance as the 'nobody' user, which can lead to code execution.","severity":"high","cvss":6.8,"epss":null,"exploited":true,"exploited_at":"2025-04-16T00:00:00+00:00","products":[{"name":"SonicWall SMA100 Appliances","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"sonicwall sma 200 firmware","fixed":["9.0.0.11-31sv"],"affected":"< 9.0.0.11-31sv","ecosystem":"vendor"},{"name":"sonicwall sma 200 firmware","fixed":["10.2.0.8-37sv"],"affected":">= 10.2.0.0, < 10.2.0.8-37sv","ecosystem":"vendor"},{"name":"sonicwall sma 200 firmware","fixed":["10.2.1.1-19sv"],"affected":">= 10.2.1.0, < 10.2.1.1-19sv","ecosystem":"vendor"},{"name":"sonicwall sma 210 firmware","fixed":["9.0.0.11-31sv"],"affected":"< 9.0.0.11-31sv","ecosystem":"vendor"},{"name":"sonicwall sma 210 firmware","fixed":["10.2.0.8-37sv"],"affected":">= 10.2.0.0, < 10.2.0.8-37sv","ecosystem":"vendor"},{"name":"sonicwall sma 210 firmware","fixed":["10.2.1.1-19sv"],"affected":">= 10.2.1.0, < 10.2.1.1-19sv","ecosystem":"vendor"},{"name":"sonicwall sma 400 firmware","fixed":["9.0.0.11-31sv"],"affected":"< 9.0.0.11-31sv","ecosystem":"vendor"},{"name":"sonicwall sma 400 firmware","fixed":["10.2.0.8-37sv"],"affected":">= 10.2.0.0, < 10.2.0.8-37sv","ecosystem":"vendor"},{"name":"sonicwall sma 400 firmware","fixed":["10.2.1.1-19sv"],"affected":">= 10.2.1.0, < 10.2.1.1-19sv","ecosystem":"vendor"},{"name":"sonicwall sma 410 firmware","fixed":["9.0.0.11-31sv"],"affected":"< 9.0.0.11-31sv","ecosystem":"vendor"},{"name":"sonicwall sma 410 firmware","fixed":["10.2.0.8-37sv"],"affected":">= 10.2.0.0, < 10.2.0.8-37sv","ecosystem":"vendor"},{"name":"sonicwall sma 410 firmware","fixed":["10.2.1.1-19sv"],"affected":">= 10.2.1.0, < 10.2.1.1-19sv","ecosystem":"vendor"},{"name":"sonicwall sma 500v","fixed":["9.0.0.11-31sv"],"affected":"< 9.0.0.11-31sv","ecosystem":"vendor"},{"name":"sonicwall sma 500v","fixed":["10.2.0.8-37sv"],"affected":">= 10.2.0.0, < 10.2.0.8-37sv","ecosystem":"vendor"},{"name":"sonicwall sma 500v","fixed":["10.2.1.1-19sv"],"affected":">= 10.2.1.0, < 10.2.1.1-19sv","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","self-hosted","sma100","sonicwall"],"not_affected_if":["management-interface-restricted","no-sma100-appliance"],"how_to_check":null,"fix":"Apply the mitigations in the vendor advisory per CISA instructions; if none are available, discontinue use of the appliance. Specific fixed firmware versions: unknown","status":"open","published_at":"2021-09-27T18:15:08+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:48:47+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:48:47Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations in the vendor advisory per CISA instructions; if none are available, discontinue use of the appliance. Specific fixed firmware versions: unknown","reach":"network","summary":"SonicWall SMA100 appliances have an OS command injection flaw in the management interface. A remote attacker with a valid login can run arbitrary commands on the appliance as the 'nobody' user, which can lead to code execution.","category":"infrastructure","who_cares":["sonicwall","sma100","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary OS commands on the appliance as nobody user","analyst_note":"Find SonicWall advisory for CVE-2021-20035 to confirm affected and fixed firmware versions and the exact mitigation steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-sma100-appliance","management-interface-restricted"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000442,"input_tokens":2570,"output_tokens":371,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':171C '-20035':17A,20A '-2021':16A,19A '200':26A,30A,34A '210':38A,42A,46A '22':170C '400':50A,54A,58A '410':62A,66A,70A '500v':74A,77A,80A 'action':161C 'allow':11A,139C 'appli':162C 'applianc':90B,114B,127C 'appliances':23A 'applic':168C 'arbitrari':110B,146C 'attack':103B,143C 'authent':14A,142C 'bod':169C 'cisa':159C 'cloud':174C 'code':123B,157C 'command':94B,111B,131C,147C 'contain':128C 'could':153C 'cve':15A,18A 'discontinu':177C 'element':5A 'execut':124B,158C 'exploit':81B 'firmware':27A,31A,35A,39A,43A,47A,51A,55A,59A,63A,67A,71A 'flaw':96B 'follow':167C 'guidanc':172C 'host':85B 'improp':1A 'infrastructur':82B 'inject':95B,132C,145C 'instruct':166C 'interfac':10A,100B,137C 'lead':121B,155C 'login':107B 'manag':9A,99B,136C 'mitig':163C,183C 'neutral':2A 'nobodi':117B,150C 'os':93B,130C 'per':164C 'potenti':154C 'product':181C 'remot':13A,102B,141C 'requir':160C 'run':109B 'self':84B 'self-host':83B 'servic':175C 'sma':25A,29A,33A,37A,41A,45A,49A,53A,57A,61A,65A,69A,73A,76A,79A 'sma100':8A,22A,86B,89B,126C 'sonicwal':87B,88B,125C 'sonicwall':21A,24A,28A,32A,36A,40A,44A,48A,52A,56A,60A,64A,68A,72A,75A,78A 'special':4A 'unavail':185C 'use':178C 'user':118B,151C 'valid':106B 'vendor':165C 'vulner':133C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-09-27T18:15:08+00:00","kev":{"dateAdded":"2025-04-16","dueDate":"2025-05-07","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-20035","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-20035","severity":null,"published_at":"2025-04-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:46+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-20035","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20035","severity":null,"published_at":"2021-09-27T18:15:08+00:00","modified_at":"2026-06-17T03:33:11+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}