CVE-2021-20017 — OS Command Injection in Sma100 Firmware

CWE-78 — OS Command Injection3 documents3 sources

Severity

8.8HIGHNVD

EPSS

2.6%

top 14.31%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Sonicwall Sma100 Firmware Sonicwall Sma100

Timeline

PublishedMar 13

Latest updateMay 24

Description

A post-authenticated command injection vulnerability in SonicWall SMA100 allows an authenticated attacker to execute OS commands as a 'nobody' user. This vulnerability impacts SMA100 version 10.2.0.5 and earlier.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDsonicwall/sma100_firmware10.2.0.5

▶CVEListV5sonicwall/sma10010.2.0.5 and earlier

🔴Vulnerability Details

GHSA

GHSA-q863-p6pj-6qfj: A post-authenticated command injection vulnerability in SonicWall SMA100 allows an authenticated attacker to execute OS commands as a 'nobody' user↗2022-05-24

▶

CVEList

CVE-2021-20017: A post-authenticated command injection vulnerability in SonicWall SMA100 allows an authenticated attacker to execute OS commands as a 'nobody' user↗2021-03-13

▶