CVE-2021-20038

🗓️ 08 Dec 2021 09:55:20Reported by sonicwallType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 1184 Views🌐 WEB

Stack-based buffer overflow in SMA100 Apache httpd server's mod_cgi modul

Reporter	Title	Published	Views	Family All 41
zdt	SonicWall SMA 100 Series Authenticated Command Injection Exploit	13 Jan 202200:00	–	zdt
GithubExploit	Exploit for Out-of-bounds Write in Sonicwall Sma_200_Firmware	8 Aug 202203:38	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in Sonicwall Sma_200_Firmware	11 Jan 202202:25	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in Sonicwall Sma_200_Firmware	8 Aug 202203:38	–	githubexploit
ICS	2021 Top Routinely Exploited Vulnerabilities	28 Apr 202212:00	–	ics
ICS	#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities	9 Feb 202312:00	–	ics
ICS	2022 Top Routinely Exploited Vulnerabilities	3 Aug 202312:00	–	ics
ICS	North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs	25 Jul 202412:00	–	ics
attackerkb	CVE-2021-20038	8 Dec 202100:00	–	attackerkb
BDU FSTEC	The vulnerability of the Apache mod_cgi module for HTTP servers in the SonicWall network device software for the SMA series (SMA 100, SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500vl) allows attackers to execute arbitrary code.	12 Jan 202200:00	–	bdu_fstec

NVD

Vulners

Node

AND

sonicwall sma_200_firmwareMatch10.2.0.8-37sv

sonicwall sma_200_firmwareMatch10.2.1.1-19sv

sonicwall sma_200_firmwareMatch10.2.1.2-24sv

sonicwall sma_200Match-

Node

AND

sonicwall sma_210_firmwareMatch10.2.0.8-37sv

sonicwall sma_210_firmwareMatch10.2.1.1-19sv

sonicwall sma_210_firmwareMatch10.2.1.2-24sv

sonicwall sma_210Match-

Node

AND

sonicwall sma_410_firmwareMatch10.2.0.8-37sv

sonicwall sma_410_firmwareMatch10.2.1.1-19sv

sonicwall sma_410_firmwareMatch10.2.1.2-24sv

sonicwall sma_410Match-

Node

AND

sonicwall sma_400_firmwareMatch10.2.0.8-37sv

sonicwall sma_400_firmwareMatch10.2.1.1-19sv

sonicwall sma_400_firmwareMatch10.2.1.2-24sv

sonicwall sma_400Match-

Node

AND

sonicwall sma_500v_firmwareMatch10.2.0.8-37sv

sonicwall sma_500v_firmwareMatch10.2.1.1-19sv

sonicwall sma_500v_firmwareMatch10.2.1.2-24sv

sonicwall sma_500vMatch-

[
  {
    "product": "SonicWall SMA100",
    "vendor": "SonicWall",
    "versions": [
      {
        "status": "affected",
        "version": "10.2.0.8-37sv and earlier"
      },
      {
        "status": "affected",
        "version": "10.2.1.1-19sv and earlier"
      },
      {
        "status": "affected",
        "version": "10.2.1.2-24sv and earlier"
      }
    ]
  }
]

Source	Link
rapid7	www.rapid7.com/blog/post/2022/01/11/cve-2021-20038-42-sonicwall-sma-100-multiple-vulnerabilities-fixed-2/
psirt	www.psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026
github	www.github.com/jbaines-r7/badblood
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
username	request body	/cgi-bin/userLogin	Authenticated login endpoint used as a prerequisite to exploit; carries credentials in POST data.	CWE-287, CWE-200
password	request body	/cgi-bin/userLogin	Authenticated login endpoint used as a prerequisite to exploit; carries credentials in POST data.	CWE-287, CWE-200
domain	request body	/cgi-bin/userLogin	Authenticated login endpoint used as a prerequisite to exploit; carries credentials in POST data.	CWE-287, CWE-200
portalname	request body	/cgi-bin/userLogin	Authenticated login endpoint used as a prerequisite to exploit; carries credentials in POST data.	CWE-287, CWE-200
login	request body	/cgi-bin/userLogin	Authenticated login endpoint used as a prerequisite to exploit; carries credentials in POST data.	CWE-287, CWE-200
verifyCert	request body	/cgi-bin/userLogin	Authenticated login endpoint used as a prerequisite to exploit; carries credentials in POST data.	CWE-287, CWE-200
ajax	request body	/cgi-bin/userLogin	Authenticated login endpoint used as a prerequisite to exploit; carries credentials in POST data.	CWE-287, CWE-200
CERT	request body	/cgi-bin/viewcert	Endpoint used to deliver a crafted payload in CERT field to trigger command execution; uses multipart/form-data.	CWE-77, CWE-264
buttontype	request body	/cgi-bin/viewcert	Endpoint used to deliver a crafted payload in CERT field to trigger command execution; uses multipart/form-data.	CWE-77, CWE-264

17 Jun 2026 03:33Current

9.6Critical risk

Vulners AI Score9.6

CVSS 27.5

CVSS 3.19.8

EPSS0.99912

SSVC

cve-2021-20038 apache httpd buffer overflow mod_cgi sma vulnerability security advisory