Lucene search

SonicwallCVE-2021-20042

HistoryDec 08, 2021 - 10:15 a.m.

CVE-2021-20042

2021-12-0810:15:08

CWE-441

sonicwall

web.nvd.nist.gov

cve-2021-20042

sma 100

firewall bypass

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.006

Percentile

79.7%

JSON

An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

Affected configurations

Nvd

Node

sonicwallsma_200Match-

AND

sonicwallsma_200_firmwareMatch9.0.0.11-31sv

sonicwallsma_200_firmwareMatch10.2.0.8-37sv

sonicwallsma_200_firmwareMatch10.2.1.1-19sv

Node

sonicwallsma_210Match-

AND

sonicwallsma_210_firmwareMatch9.0.0.11-31sv

sonicwallsma_210_firmwareMatch10.2.0.8-37sv

sonicwallsma_210_firmwareMatch10.2.1.1-19sv

Node

sonicwallsma_410Match-

AND

sonicwallsma_410_firmwareMatch9.0.0.11-31sv

sonicwallsma_410_firmwareMatch10.2.0.8-37sv

sonicwallsma_410_firmwareMatch10.2.1.1-19sv

Node

sonicwallsma_400Match-

AND

sonicwallsma_400_firmwareMatch9.0.0.11-31sv

sonicwallsma_400_firmwareMatch10.2.0.8-37sv

sonicwallsma_400_firmwareMatch10.2.1.1-19sv

Node

sonicwallsma_500vMatch-

AND

sonicwallsma_500v_firmwareMatch9.0.0.11-31sv

sonicwallsma_500v_firmwareMatch10.2.0.8-37sv

sonicwallsma_500v_firmwareMatch10.2.1.1-19sv

VendorProductVersionCPE
sonicwallsma_200-cpe:2.3:h:sonicwall:sma_200:-:*:*:*:*:*:*:*
sonicwallsma_200_firmware9.0.0.11-31svcpe:2.3:o:sonicwall:sma_200_firmware:9.0.0.11-31sv:*:*:*:*:*:*:*
sonicwallsma_200_firmware10.2.0.8-37svcpe:2.3:o:sonicwall:sma_200_firmware:10.2.0.8-37sv:*:*:*:*:*:*:*
sonicwallsma_200_firmware10.2.1.1-19svcpe:2.3:o:sonicwall:sma_200_firmware:10.2.1.1-19sv:*:*:*:*:*:*:*
sonicwallsma_210-cpe:2.3:h:sonicwall:sma_210:-:*:*:*:*:*:*:*
sonicwallsma_210_firmware9.0.0.11-31svcpe:2.3:o:sonicwall:sma_210_firmware:9.0.0.11-31sv:*:*:*:*:*:*:*
sonicwallsma_210_firmware10.2.0.8-37svcpe:2.3:o:sonicwall:sma_210_firmware:10.2.0.8-37sv:*:*:*:*:*:*:*
sonicwallsma_210_firmware10.2.1.1-19svcpe:2.3:o:sonicwall:sma_210_firmware:10.2.1.1-19sv:*:*:*:*:*:*:*
sonicwallsma_410-cpe:2.3:h:sonicwall:sma_410:-:*:*:*:*:*:*:*
sonicwallsma_410_firmware9.0.0.11-31svcpe:2.3:o:sonicwall:sma_410_firmware:9.0.0.11-31sv:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sonicwall	sma_200	-	cpe:2.3:h:sonicwall:sma_200:-:::::::*
sonicwall	sma_200_firmware	9.0.0.11-31sv	cpe:2.3:o:sonicwall:sma_200_firmware:9.0.0.11-31sv:::::::*
sonicwall	sma_200_firmware	10.2.0.8-37sv	cpe:2.3:o:sonicwall:sma_200_firmware:10.2.0.8-37sv:::::::*
sonicwall	sma_200_firmware	10.2.1.1-19sv	cpe:2.3:o:sonicwall:sma_200_firmware:10.2.1.1-19sv:::::::*
sonicwall	sma_210	-	cpe:2.3:h:sonicwall:sma_210:-:::::::*
sonicwall	sma_210_firmware	9.0.0.11-31sv	cpe:2.3:o:sonicwall:sma_210_firmware:9.0.0.11-31sv:::::::*
sonicwall	sma_210_firmware	10.2.0.8-37sv	cpe:2.3:o:sonicwall:sma_210_firmware:10.2.0.8-37sv:::::::*
sonicwall	sma_210_firmware	10.2.1.1-19sv	cpe:2.3:o:sonicwall:sma_210_firmware:10.2.1.1-19sv:::::::*
sonicwall	sma_410	-	cpe:2.3:h:sonicwall:sma_410:-:::::::*
sonicwall	sma_410_firmware	9.0.0.11-31sv	cpe:2.3:o:sonicwall:sma_410_firmware:9.0.0.11-31sv:::::::*

Rows per page:

1-10 of 201

CNA Affected

[
  {
    "product": "SonicWall SMA100",
    "vendor": "SonicWall",
    "versions": [
      {
        "status": "affected",
        "version": "9.0.0.11-31sv and earlier"
      },
      {
        "status": "affected",
        "version": "10.2.0.8-37sv and earlier"
      },
      {
        "status": "affected",
        "version": "10.2.1.1-19sv and earlier"
      },
      {
        "status": "affected",
        "version": "10.2.1.2-24sv and earlier"
      }
    ]
  }
]

References

psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.006

Percentile

79.7%

JSON

Related for CVE-2021-20042