CVE-2021-20034

🗓️ 27 Sep 2021 17:20:10Reported by sonicwallType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 129 Views🌐 WEB

Improper access control vulnerability in SMA100 allows remote unauthenticated attacker to bypass path traversal checks and delete arbitrary file, potentially resulting in factory default settings reboot.

Reporter	Title	Published	Views	Family All 18
0day.today	SonicWall SMA 10.2.1.0-17sv - Password Reset Vulnerability	20 Oct 202100:00	–	zdt
ATTACKERKB	CVE-2021-20034	27 Sep 202100:00	–	attackerkb
BDU FSTEC	The vulnerability of the SONICWALL Ethernet switch control interface of the SMA 100 series allows a intruder to alter the device’s configuration to the factory settings and trigger a failure in the target system’s service.	13 Oct 202100:00	–	bdu_fstec
Circl	CVE-2021-20034	24 Sep 202117:46	–	circl
CNNVD	Sonicwall SMA100 路径遍历漏洞	24 Sep 202100:00	–	cnnvd
Cvelist	CVE-2021-20034	27 Sep 202117:20	–	cvelist
Exploit DB	SonicWall SMA 10.2.1.0-17sv - Password Reset	20 Oct 202100:00	–	exploitdb
EUVD	EUVD-2021-7497	3 Oct 202520:07	–	euvd
Malwarebytes	SonicWall warns users to patch critical vulnerability “as soon as possible”	24 Sep 202111:09	–	malwarebytes
NCSC	Vulnerabilities fixed in SonicWall SMA100 series	24 Sep 202100:00	–	ncsc

NVD

Vulners

Node

sonicwall sma_200_firmwareRange≤9.0.0.10-28sv

sonicwall sma_200_firmwareRange10.2.0.0–10.2.0.7-34sv

sonicwall sma_200_firmwareRange10.2.1.0–10.2.1.0-17sv

AND

sonicwall sma_200Match-

Node

sonicwall sma_210_firmwareRange≤9.0.0.10-28sv

sonicwall sma_210_firmwareRange10.2.0.0–10.2.0.7-34sv

sonicwall sma_210_firmwareRange10.2.1.0–10.2.1.0-17sv

AND

sonicwall sma_210Match-

Node

sonicwall sma_400_firmwareRange≤9.0.0.10-28sv

sonicwall sma_400_firmwareRange10.2.0.0–10.2.0.7-34sv

sonicwall sma_400_firmwareRange10.2.1.0–10.2.1.0-17sv

AND

sonicwall sma_400Match-

Node

sonicwall sma_410_firmwareRange≤9.0.0.10-28sv

sonicwall sma_410_firmwareRange10.2.0.0–10.2.0.7-34sv

sonicwall sma_410_firmwareRange10.2.1.0–10.2.1.0-17sv

AND

sonicwall sma_410Match-

Node

sonicwall sma_500vRange≤9.0.0.10-28sv

sonicwall sma_500vRange10.2.0.0–10.2.0.7-34sv

sonicwall sma_500vRange10.2.1.0–10.2.1.0-17sv

[
  {
    "product": "SMA100",
    "vendor": "SonicWall",
    "versions": [
      {
        "status": "affected",
        "version": "9.0.0.10-28sv and earlier"
      },
      {
        "status": "affected",
        "version": "10.2.0.7-34sv and earlier"
      },
      {
        "status": "affected",
        "version": "10.2.1.0-17sv and earlier"
      }
    ]
  }
]

Source	Link
psirt	www.psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0021
packetstormsecurity	www.packetstormsecurity.com/files/164564/SonicWall-SMA-10.2.1.0-17sv-Password-Reset.html

Parameter	Position	Path	Description	CWE
hdl	query param	/cgi-bin/handleWAFRedirect?hdl=../flash/etc/EasyAccess/var/conf/persist.db	Path traversal leads to unauthorized access to/delete arbitrary file via handleWAFRedirect parameter	CWE-284, CWE-22

21 Nov 2024 05:45Current

9.2High risk

Vulners AI Score9.2

CVSS 26.4

CVSS 3.19.1

EPSS0.81137