SonicWall SonicWall SMA100
11 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2021-20050 | 10.2.0.8-37sv and earlier ; 10.2.1.2-24sv and earlier | An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user l | HIGH 7.5 | 0.9 % | ||
| CVE-2021-20049 | 10.2.0.8-37sv and earlier ; 10.2.1.2-24sv and earlier | A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration base | HIGH 7.5 | 1.4 % | ||
| CVE-2021-20045 | 10.2.0.8-37sv and earlier ; 10.2.1.1-19sv and earlier ; 10.2.1.2-24sv and earlier | A buffer overflow vulnerability in SMA100 sonicfiles RAC_COPY_TO (RacNumber 36) method allows a remote unauthenticated attacker to potential | CRITICAL 9.8 | 25 % | ||
| CVE-2021-20044 | 10.2.0.8-37sv and earlier ; 10.2.1.1-19sv and earlier ; 10.2.1.2-24sv and earlier | A post-authentication remote command injection vulnerability in SonicWall SMA100 allows a remote authenticated attacker to execute OS system | HIGH 8.8 | 40 % | ||
| CVE-2021-20043 | 10.2.0.8-37sv and earlier ; 10.2.1.1-19sv and earlier ; 10.2.1.2-24sv and earlier | A Heap-based buffer overflow vulnerability in SonicWall SMA100 getBookmarks method allows a remote authenticated attacker to potentially exe | HIGH 8.8 | 23 % | ||
| CVE-2021-20042 | 9.0.0.11-31sv and earlier ; 10.2.0.8-37sv and earlier ; 10.2.1.1-19sv and earlier ; … | An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules. This | CRITICAL 9.8 | 3.7 % | ||
| CVE-2021-20041 | 9.0.0.11-31sv and earlier ; 10.2.0.8-37sv and earlier ; 10.2.1.1-19sv and earlier ; … | An unauthenticated and remote adversary can consume all of the device's CPU due to crafted HTTP requests sent to SMA100 /fileshare/sonicfile | HIGH 7.5 | 21 % | ||
| CVE-2021-20040 | 10.2.0.8-37sv and earlier ; 10.2.1.1-19sv and earlier ; 10.2.1.2-24sv and earlier | A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages or | HIGH 7.5 | 25 % | ||
| CVE-2021-20039 | 9.0.0.11-31sv and earlier ; 10.2.0.8-37sv and earlier ; 10.2.1.1-19sv and earlier ; … | Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenti | HIGH 8.8 | 79 % | ||
| CVE-2021-20038 | 10.2.0.8-37sv and earlier ; 10.2.1.1-19sv and earlier ; 10.2.1.2-24sv and earlier | A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthentic | CRITICAL 9.8 | 100 % | KEV | |
| CVE-2021-20016 | SMA100 build version 10.x | A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access | CRITICAL 9.8 | 40 % | KEV |