CVE-2021-20044

published 2021-12-08

CVE-2021-20044: A post-authentication remote command injection vulnerability in SonicWall SMA100 allows a remote authenticated attacker to execute OS system commands in the…

Priority P2 70 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

A post-authentication remote command injection vulnerability in SonicWall SMA100 allows a remote authenticated attacker to execute OS system commands in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

Affected

17 ranges

Vendor	Product	Version range	Fixed in
sonicwall	sma	—	—
sonicwall	sma_200_firmware	—	—
sonicwall	sma_200_firmware	—	—
sonicwall	sma_210_firmware	—	—
sonicwall	sma_210_firmware	—	—
sonicwall	sma_400_firmware	—	—
sonicwall	sma_400_firmware	—	—
sonicwall	sma_410_firmware	—	—
sonicwall	sma_410_firmware	—	—
sonicwall	sma_500v_firmware	—	—
sonicwall	sma_500v_firmware	—	—
sonicwall	sonicwall_sma100	—	—
sonicwall	sonicwall_sma100	—	—
sonicwall	sonicwall_sma100	—	—
zsh	zsh	>= 0 < 5.4.2-3ubuntu3.2	5.4.2-3ubuntu3.2
zsh	zsh	>= 0 < 5.8-3ubuntu1.1	5.8-3ubuntu1.1
zsh	zsh	>= 0 < 5.1.1-1ubuntu2.3+esm1	5.1.1-1ubuntu2.3+esm1

Detection & IOCs extracted from sources · hover to see the quote

url /__api__/v1/management/systemsettings/file

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SERVER SonicWall SMA Post-Auth Python Management API Remote Code Execution (CVE-2021-20044)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/__api__/v1/management/systemsettings/file"; fast_pattern; http.request_body; content:"name|3d 22|upfile|22|"; content:"|50 4b|"; distance:0; reference:url,www.nccgroup.com/us/research-blog/technical-advisory-sonicwall-sma-100-series-post-authentication-remote-command-execution-cve-2021-20044/; reference:cve,2021-20044; classtype:web-application-attack; sid:2061724; rev:1; metadata:affected_product SonicWall, attack_target Server, tls_state TLSDecrypt, created_at 2025_04_17, cve CVE_2021_20044, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence Medium, signature_severity Major, tag Exploit, updated_at 2025_04_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

bytes

|50 4b|

• → Exploit traffic uses HTTP POST method to the URI /__api__/v1/management/systemsettings/file — monitor for POST requests to this endpoint on SonicWall SMA100-series appliances.
• → Request body contains a multipart field named 'upfile' (encoded as name="upfile") — look for this field name in POST body content targeting the management API.
• → The uploaded file body begins with PK magic bytes (|50 4b|), indicating a ZIP-format payload is delivered as part of the exploit — flag file uploads with PK header to this endpoint.
• → Exploit is post-authentication; correlate suspicious API calls to /__api__/v1/management/systemsettings/file with prior successful authentication events on SMA 200, 210, 400, 410, and 500v appliances. ↗
• → Snort/Suricata SID 2061724 (ET rule) covers this exploit — ensure this signature is enabled and that TLS inspection (TLSDecrypt/SSLDecrypt) is active, as the rule metadata flags tls_state TLSDecrypt.

• · The Snort/Suricata rule (SID 2061724) requires TLS decryption to be effective — without TLSDecrypt/SSLDecrypt deployment, the rule will not inspect encrypted traffic and will miss exploit attempts.
• · Detection is only meaningful for SonicWall SMA 200, 210, 400, 410, and 500v appliances — scope monitoring accordingly to avoid false positives on other devices. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

osv 7.8 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78