SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2021-20038 · Published 08/12/2021 · updated 17/06/2026

SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 28/01/2022. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.

Package	Affected versions	Patched versions
SMA 100 Appliances SonicWall	Versions not published yet (product named by CISA KEV)

Description

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.

References

jbaines-r7/badblood · Exploit
psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026 · Vendor Advisory
rapid7.com/blog/post/2022/01/11/cve-2021-20038-42-sonicwall-sma-100-multiple-vulnerabilities-fixed-2 · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2021-20038

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free