Lucene search

SonicwallCVE-2021-20043

HistoryDec 08, 2021 - 10:15 a.m.

CVE-2021-20043

2021-12-0810:15:08

CWE-787

CWE-122

sonicwall

web.nvd.nist.gov

sonicwall

sma100

vulnerability

remote attacker

buffer overflow

code execution

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

59.6%

JSON

A Heap-based buffer overflow vulnerability in SonicWall SMA100 getBookmarks method allows a remote authenticated attacker to potentially execute code as the nobody user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

Affected configurations

Nvd

Node

sonicwallsma_200_firmwareMatch10.2.0.8-37sv

sonicwallsma_200_firmwareMatch10.2.1.1-19sv

AND

sonicwallsma_200Match-

Node

sonicwallsma_210_firmwareMatch10.2.0.8-37sv

sonicwallsma_210_firmwareMatch10.2.1.1-19sv

AND

sonicwallsma_210Match-

Node

sonicwallsma_410_firmwareMatch10.2.0.8-37sv

sonicwallsma_410_firmwareMatch10.2.1.1-19sv

AND

sonicwallsma_410Match-

Node

sonicwallsma_400_firmwareMatch10.2.0.8-37sv

sonicwallsma_400_firmwareMatch10.2.1.1-19sv

AND

sonicwallsma_400Match-

Node

sonicwallsma_500v_firmwareMatch10.2.0.8-37sv

sonicwallsma_500v_firmwareMatch10.2.1.1-19sv

AND

sonicwallsma_500vMatch-

VendorProductVersionCPE
sonicwallsma_200_firmware10.2.0.8-37svcpe:2.3:o:sonicwall:sma_200_firmware:10.2.0.8-37sv:*:*:*:*:*:*:*
sonicwallsma_200_firmware10.2.1.1-19svcpe:2.3:o:sonicwall:sma_200_firmware:10.2.1.1-19sv:*:*:*:*:*:*:*
sonicwallsma_200-cpe:2.3:h:sonicwall:sma_200:-:*:*:*:*:*:*:*
sonicwallsma_210_firmware10.2.0.8-37svcpe:2.3:o:sonicwall:sma_210_firmware:10.2.0.8-37sv:*:*:*:*:*:*:*
sonicwallsma_210_firmware10.2.1.1-19svcpe:2.3:o:sonicwall:sma_210_firmware:10.2.1.1-19sv:*:*:*:*:*:*:*
sonicwallsma_210-cpe:2.3:h:sonicwall:sma_210:-:*:*:*:*:*:*:*
sonicwallsma_410_firmware10.2.0.8-37svcpe:2.3:o:sonicwall:sma_410_firmware:10.2.0.8-37sv:*:*:*:*:*:*:*
sonicwallsma_410_firmware10.2.1.1-19svcpe:2.3:o:sonicwall:sma_410_firmware:10.2.1.1-19sv:*:*:*:*:*:*:*
sonicwallsma_410-cpe:2.3:h:sonicwall:sma_410:-:*:*:*:*:*:*:*
sonicwallsma_400_firmware10.2.0.8-37svcpe:2.3:o:sonicwall:sma_400_firmware:10.2.0.8-37sv:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sonicwall	sma_200_firmware	10.2.0.8-37sv	cpe:2.3:o:sonicwall:sma_200_firmware:10.2.0.8-37sv:::::::*
sonicwall	sma_200_firmware	10.2.1.1-19sv	cpe:2.3:o:sonicwall:sma_200_firmware:10.2.1.1-19sv:::::::*
sonicwall	sma_200	-	cpe:2.3:h:sonicwall:sma_200:-:::::::*
sonicwall	sma_210_firmware	10.2.0.8-37sv	cpe:2.3:o:sonicwall:sma_210_firmware:10.2.0.8-37sv:::::::*
sonicwall	sma_210_firmware	10.2.1.1-19sv	cpe:2.3:o:sonicwall:sma_210_firmware:10.2.1.1-19sv:::::::*
sonicwall	sma_210	-	cpe:2.3:h:sonicwall:sma_210:-:::::::*
sonicwall	sma_410_firmware	10.2.0.8-37sv	cpe:2.3:o:sonicwall:sma_410_firmware:10.2.0.8-37sv:::::::*
sonicwall	sma_410_firmware	10.2.1.1-19sv	cpe:2.3:o:sonicwall:sma_410_firmware:10.2.1.1-19sv:::::::*
sonicwall	sma_410	-	cpe:2.3:h:sonicwall:sma_410:-:::::::*
sonicwall	sma_400_firmware	10.2.0.8-37sv	cpe:2.3:o:sonicwall:sma_400_firmware:10.2.0.8-37sv:::::::*

Rows per page:

1-10 of 151

CNA Affected

[
  {
    "product": "SonicWall SMA100",
    "vendor": "SonicWall",
    "versions": [
      {
        "status": "affected",
        "version": "10.2.0.8-37sv and earlier"
      },
      {
        "status": "affected",
        "version": "10.2.1.1-19sv and earlier"
      },
      {
        "status": "affected",
        "version": "10.2.1.2-24sv and earlier"
      }
    ]
  }
]

References

psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026

Social References

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

59.6%

JSON

Related for CVE-2021-20043