Lucene search

SonicwallCVE-2021-20034

HistorySep 27, 2021 - 6:15 p.m.

CVE-2021-20034

2021-09-2718:15:08

CWE-284

CWE-22

sonicwall

web.nvd.nist.gov

access control

vulnerability

sma100

remote attacker

path traversal

file deletion

factory default

reboot

nvd

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.641

Percentile

97.9%

JSON

An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.

Affected configurations

Nvd

Node

sonicwallsma_200_firmwareRange≤9.0.0.10-28sv

sonicwallsma_200_firmwareRange10.2.0.0–10.2.0.7-34sv

sonicwallsma_200_firmwareRange10.2.1.0–10.2.1.0-17sv

AND

sonicwallsma_200Match-

Node

sonicwallsma_210_firmwareRange≤9.0.0.10-28sv

sonicwallsma_210_firmwareRange10.2.0.0–10.2.0.7-34sv

sonicwallsma_210_firmwareRange10.2.1.0–10.2.1.0-17sv

AND

sonicwallsma_210Match-

Node

sonicwallsma_400_firmwareRange≤9.0.0.10-28sv

sonicwallsma_400_firmwareRange10.2.0.0–10.2.0.7-34sv

sonicwallsma_400_firmwareRange10.2.1.0–10.2.1.0-17sv

AND

sonicwallsma_400Match-

Node

sonicwallsma_410_firmwareRange≤9.0.0.10-28sv

sonicwallsma_410_firmwareRange10.2.0.0–10.2.0.7-34sv

sonicwallsma_410_firmwareRange10.2.1.0–10.2.1.0-17sv

AND

sonicwallsma_410Match-

Node

sonicwallsma_500vRange≤9.0.0.10-28sv

sonicwallsma_500vRange10.2.0.0–10.2.0.7-34sv

sonicwallsma_500vRange10.2.1.0–10.2.1.0-17sv

VendorProductVersionCPE
sonicwallsma_200_firmware*cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:*
sonicwallsma_200-cpe:2.3:h:sonicwall:sma_200:-:*:*:*:*:*:*:*
sonicwallsma_210_firmware*cpe:2.3:o:sonicwall:sma_210_firmware:*:*:*:*:*:*:*:*
sonicwallsma_210-cpe:2.3:h:sonicwall:sma_210:-:*:*:*:*:*:*:*
sonicwallsma_400_firmware*cpe:2.3:o:sonicwall:sma_400_firmware:*:*:*:*:*:*:*:*
sonicwallsma_400-cpe:2.3:h:sonicwall:sma_400:-:*:*:*:*:*:*:*
sonicwallsma_410_firmware*cpe:2.3:o:sonicwall:sma_410_firmware:*:*:*:*:*:*:*:*
sonicwallsma_410-cpe:2.3:h:sonicwall:sma_410:-:*:*:*:*:*:*:*
sonicwallsma_500v*cpe:2.3:a:sonicwall:sma_500v:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sonicwall	sma_200_firmware	*	cpe:2.3:o:sonicwall:sma_200_firmware::::::::
sonicwall	sma_200	-	cpe:2.3:h:sonicwall:sma_200:-:::::::*
sonicwall	sma_210_firmware	*	cpe:2.3:o:sonicwall:sma_210_firmware::::::::
sonicwall	sma_210	-	cpe:2.3:h:sonicwall:sma_210:-:::::::*
sonicwall	sma_400_firmware	*	cpe:2.3:o:sonicwall:sma_400_firmware::::::::
sonicwall	sma_400	-	cpe:2.3:h:sonicwall:sma_400:-:::::::*
sonicwall	sma_410_firmware	*	cpe:2.3:o:sonicwall:sma_410_firmware::::::::
sonicwall	sma_410	-	cpe:2.3:h:sonicwall:sma_410:-:::::::*
sonicwall	sma_500v	*	cpe:2.3:a:sonicwall:sma_500v::::::::

CNA Affected

[
  {
    "product": "SMA100",
    "vendor": "SonicWall",
    "versions": [
      {
        "status": "affected",
        "version": "9.0.0.10-28sv and earlier"
      },
      {
        "status": "affected",
        "version": "10.2.0.7-34sv and earlier"
      },
      {
        "status": "affected",
        "version": "10.2.1.0-17sv and earlier"
      }
    ]
  }
]