CVE-2021-20038
CRITICAL KEV RANSOMWARE NUCLEISonicWall SMA 100 Series Firmware <= 10.2.1.2-24sv - Unauthenticated Stack-based Buffer Overflow
Title source: llmExploitation Summary
CVE-2021-20038 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added January 28, 2022, with confirmed use in ransomware campaigns. EIP tracks 3 public exploits from researchers including vesperp, anir0y. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2021-20038, a SonicWall SSL-VPN RCE vulnerability. The exploit leverages a command injection via the User-Agent header to execute arbitrary commands on the target system.
Description
A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.
Exploits (3)
This repository contains a functional exploit for CVE-2021-20038, a SonicWall SSL-VPN RCE vulnerability. The exploit leverages a command injection via the User-Agent header to execute arbitrary commands on the target system.
This repository contains a functional exploit for CVE-2021-20038, a stack buffer overflow in SonicWall SMA100 SSL-VPN CGI binaries. It includes a Docker-based lab environment with vulnerable containers, exploit skeletons, and working solutions for both CVE-2021-20038 and CVE-2024-53704.
The repository contains a functional exploit for CVE-2021-20038, a stack-based buffer overflow in the SonicWall SMA-100 series firmware versions 10.2.1.x. The exploit opens a telnet bind shell on port 1270, achieving execution as the 'nobody' user.
Nuclei Templates (1)
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H