Medium severity6.5CISA KEVNVD Advisory· Published Sep 27, 2021· Updated Jun 17, 2026

CVE-2021-20035

Description

Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.

Affected products

SonicWall/Sma 500v
cpe:2.3:a:sonicwall:sma_500v:*:*:*:*:*:*:*:*
Range: <9.0.0.11-31sv
SonicWall/Sma 200 Firmware
cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:*
Range: <9.0.0.11-31sv
SonicWall/Sma 210 Firmware
cpe:2.3:o:sonicwall:sma_210_firmware:*:*:*:*:*:*:*:*
Range: <9.0.0.11-31sv
SonicWall/Sma 400 Firmware
cpe:2.3:o:sonicwall:sma_400_firmware:*:*:*:*:*:*:*:*
Range: <9.0.0.11-31sv
SonicWall/Sma 410 Firmware
cpe:2.3:o:sonicwall:sma_410_firmware:*:*:*:*:*:*:*:*
Range: <9.0.0.11-31sv
SonicWall/SMA100llm-fuzzy2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: 9.0.0.10-28sv and earlier

Patches

Vulnerability mechanics

References

psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022nvdVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.003
exploit	0.000
kev	0.120
patch	0.000
ransomware	0.000