CVE-2020-5146 — OS Command Injection in SMA 100 Firmware

CWE-78 — OS Command Injection3 documents3 sources
Severity
7.2HIGHNVD
EPSS
2.3%
top 15.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Sonicwall SMA 100 FirmwareSonicwall Sma100
Timeline
PublishedJan 9
Latest updateMay 24

Description

A vulnerability in SonicWall SMA100 appliance allow an authenticated management-user to perform OS command injection using HTTP POST parameters. This vulnerability affected SMA100 Appliance version 10.2.0.2-20sv and earlier.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶NVDsonicwall/sma_100_firmware10.2.0.2-20sv
▶CVEListV5sonicwall/sma10010.2.0.2-20sv and earlier

🔴Vulnerability Details

2
GHSA
GHSA-6w86-cqhf-wpxg: A vulnerability in SonicWall SMA100 appliance allow an authenticated management-user to perform OS command injection using HTTP POST parameters↗2022-05-24
▶
CVEList
CVE-2020-5146: A vulnerability in SonicWall SMA100 appliance allow an authenticated management-user to perform OS command injection using HTTP POST parameters↗2021-01-09
▶
CVE-2020-5146 — OS Command Injection | cvebase