CVE-2021-20018 — Sensitive Information Exposure in Sma100 Firmware

CWE-200 — Sensitive Information Exposure CWE-287 — Improper Authentication3 documents3 sources

Severity

4.9MEDIUMNVD

EPSS

0.1%

top 74.17%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Sonicwall Sma100 Firmware Sonicwall Sma100

Timeline

PublishedMar 13

Latest updateMay 24

Description

A post-authenticated vulnerability in SonicWall SMA100 allows an attacker to export the configuration file to the specified email address. This vulnerability impacts SMA100 version 10.2.0.5 and earlier.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages2 packages

▶NVDsonicwall/sma100_firmware10.2.0.5

▶CVEListV5sonicwall/sma10010.2.0.5 and earlier

🔴Vulnerability Details

GHSA

GHSA-h7wr-5x75-2c5h: A post-authenticated vulnerability in SonicWall SMA100 allows an attacker to export the configuration file to the specified email address↗2022-05-24

▶

CVEList

CVE-2021-20018: A post-authenticated vulnerability in SonicWall SMA100 allows an attacker to export the configuration file to the specified email address↗2021-03-13

▶