CVE DatabaseCVE-2021-20035

Updated 2026-06-17한국어 권고문 →

CVE-2021-200356.5/MEDIUMCISA KEVCWE-78CWE-78

SonicWall SMA 100 Management Interface Remote Command Injection Vulnerability (CVE-2021-20035) Analysis and Mitigation Guide

⚡ Jump to Patch

Affected Vendors

sonicwall

Affected Components

sma100, sma 200, sma 210, sma 400, sma 410, sma 500v

Published Date

2021-09-27

CVSS v3.1

6.5

MEDIUM

EPSS (30d)

4.4%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

SonicWall SMA 100 series firmware versions 10.2.1.1-29sv and earlier, 10.2.0.8-37sv and earlier, and 9.0.0.11-31sv and earlier

Impact

A remote authenticated attacker can inject arbitrary commands via the management interface, executing code as the 'nobody' user and potentially causing a Denial of Service (DoS)

Mitigation

Immediately upgrade the SMA 100 firmware to the latest patched versions (e.g., 10.2.1.2-34sv or higher) as recommended by the vendor

Affected Products & Version Scope

SonicWall SMA 100 Series (SMA 200, 210, 400, 410, 500v) running firmware versions 10.2.1.1-29sv and below, 10.2.0.8-37sv and below, and 9.0.0.11-31sv and below

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Log in to the MySonicWall portal, download the appropriate patched firmware for your appliance model, and perform the upgrade.

bash

# Verify the current firmware version via CLI
show version

# Recommended secure versions:
# - For 10.2.1.x: Upgrade to 10.2.1.2-34sv or higher
# - For 10.2.0.x: Upgrade to 10.2.0.9-41sv or higher
# - For 9.0.0.x: Upgrade to 9.0.0.12-38sv or higher

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, restrict access to the management interface to trusted administrative IP addresses only.

bash

# Example ACL to restrict management interface access (e.g., port 8443) to a trusted admin host
access-list admin_only permit tcp host 192.168.10.50 any eq 8443
access-list admin_only deny tcp any any eq 8443

3. Log Audit & IoC Verification Commands

Inspect the web server access logs for suspicious characters or command injection patterns.

bash

# Search web access logs for common command injection payloads (semicolons, pipes, backticks, etc.)
grep -E '(%3B|%26|%7C|;|\||&|`|\$\()' /var/log/httpd/access_log

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active exploitation in the wild (CISA KEV), immediately upgrade your SonicWall SMA 100 appliances to the latest secure firmware version.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-20035) is an OS command injection vulnerability in the web-based management interface of SonicWall SMA 100 series appliances. The root cause is the improper neutralization of special elements and shell metacharacters in user-supplied inputs before passing them to system command execution functions (CWE-78).

2. Exploitation Mechanics & Attack Scenario

An authenticated attacker with access to the SMA 100 management interface can craft malicious HTTP requests containing shell metacharacters (such as ;, &, or |) within specific input parameters. When the backend server processes these parameters without adequate validation, the injected commands are executed on the underlying operating system with the privileges of the 'nobody' user, which can lead to system instability or a Denial of Service (DoS).

3. Infrastructure & Business Impact

As this vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, it represents a high-risk threat actively targeted by adversaries in the wild. Successful exploitation can disrupt secure remote access infrastructure, leading to operational downtime and loss of availability for critical business networks.

Official Vendor Advisories & References

NVD Original English Description

Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022

Source: PSIRT@sonicwall.com · Vendor Advisory

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20035

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2021-20035)

FAQ

Q1. How critical is CVE-2021-20035 and is it actively exploited in the wild?

CVE-2021-20035 is rated CVSS 6.5 (MEDIUM) with a 30-day EPSS exploitation probability of 4.4%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2021-20035?

Primary impacted vendors include sonicwall across sma100, sma 200, sma 210, sma 400, sma 410, sma 500v. Scope summary: SonicWall SMA 100 Series (SMA 200, 210, 400, 410, 500v) running firmware versions 10.2.1.1-29sv and below, 10.2.0.8-37sv and below, and 9.0.0.11-31sv and below

Q3. What temporary mitigations or workarounds exist for CVE-2021-20035 before patching?

[Mitigation] Immediately upgrade the SMA 100 firmware to the latest patched versions (e.g., 10.2.1.2-34sv or higher) as recommended by the vendor Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION