CVE-2021-20035
MEDIUM KEVSonicwall Sma 200 Firmware < 9.0.0.11-31sv - OS Command Injection
Title source: ruleDescription
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.
Scores
CVSS v3
6.5
EPSS
0.0454
EPSS Percentile
89.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Details
CISA KEV
2025-04-16
VulnCheck KEV
2025-04-15
ENISA EUVD
EUVD-2021-7498
CWE
CWE-78
Status
published
Products (5)
sonicwall/sma_200_firmware
< 9.0.0.11-31sv
sonicwall/sma_210_firmware
< 9.0.0.11-31sv
sonicwall/sma_400_firmware
< 9.0.0.11-31sv
sonicwall/sma_410_firmware
< 9.0.0.11-31sv
sonicwall/sma_500v
< 9.0.0.11-31sv
Published
Sep 27, 2021
KEV Added
Apr 16, 2025
Tracked Since
Feb 18, 2026