{"id":"CVE-2021-20038","kind":"vulnerability","aliases":["CVE-2021-20038"],"related":[],"title":"SonicWall SMA 100 Appliances: SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability","description":"A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.","summary":"SonicWall SMA 100 series VPN/access appliances contain an unauthenticated stack-based buffer overflow. An attacker who can reach the device over the network can execute code on it.","severity":"critical","cvss":9.8,"epss":0.99912,"exploited":true,"exploited_at":"2022-01-28T00:00:00+00:00","products":[{"name":"SonicWall SMA 100 Appliances","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ransomware","self-hosted","sma-100","sonicwall","vpn"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the SonicWall update for SMA 100 appliances per vendor instructions (CISA KEV required action); the fixed firmware version is unknown from these sources.","status":"open","published_at":"2021-12-08T10:15:07+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:28:57+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:28:57Z","model":"claude-haiku-5-5","output":{"fix":"Apply the SonicWall update for SMA 100 appliances per vendor instructions (CISA KEV required action); the fixed firmware version is unknown from these sources.","reach":"internet","impact":"high","summary":"SonicWall SMA 100 series VPN/access appliances contain an unauthenticated stack-based buffer overflow. An attacker who can reach the device over the network can execute code on it.","category":"infrastructure","who_cares":["sonicwall","sma-100","self-hosted","vpn"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs code on the appliance and its VPN traffic","analyst_note":"Find the fixed firmware version and affected release list in SonicWall's advisory (SNWLID for CVE-2021-20038) and a host-side indicator-of-compromise check.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000469,"input_tokens":2864,"output_tokens":366,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-100':32B '-19':112C '-20038':17A,20A '-2021':16A,19A '-24':115C '-37':109C '10.2.0.8':108C '10.2.1.1':111C '10.2.1.2':114C '100':3A,7A,23A,37B '200':100C '210':101C '400':102C '410':103C '500v':105C 'affect':98C 'allow':80C 'apach':71C 'applianc':4A,8A,40B,95C,106C 'appliances':24A 'attack':50B,84C 'base':11A,46B,65C 'buffer':12A,47B,66C 'cgi':76C 'code':61B,88C 'contain':41B 'cve':15A,18A 'devic':55B 'earlier':118C 'environ':78C 'execut':60B,87C 'exploit':25B 'firmwar':107C 'host':30B 'httpd':72C 'infrastructur':26B 'mod':75C 'modul':77C 'network':58B 'nobodi':91C 'overflow':13A,48B,67C 'potenti':86C 'ransomwar':27B 'reach':53B 'remot':82C 'self':29B 'self-host':28B 'seri':38B 'server':73C 'sma':2A,6A,22A,31B,36B,99C 'sma100':70C 'sonicwal':1A,5A,33B,35B 'sonicwall':21A 'stack':10A,45B,64C 'stack-bas':9A,44B,63C 'sv':110C,113C,116C 'unauthent':43B,83C 'user':92C 'variabl':79C 'version':119C 'vpn':34B 'vpn/access':39B 'vulner':14A,68C,97C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-12-08T10:15:07+00:00","kev":{"dateAdded":"2022-01-28","dueDate":"2022-02-11","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-20038","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-20038","severity":null,"published_at":"2022-01-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T14:39:41+00:00","note":null},{"source":"epss","external_id":"CVE-2021-20038","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-20038","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-20038","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20038","severity":null,"published_at":"2021-12-08T10:15:07+00:00","modified_at":"2026-06-17T03:33:11+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}