CVE-2021-20034: sonicwall sma_200_firmware Improper Access Control
Vulnerability summary
CVE-2021-20034 is a critical (CVSS 9.1) Improper Access Control vulnerability in sonicwall sma_200_firmware. EPSS estimates a 81.01% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 27-09-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
81.01%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 81.01% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
SonicWall SMA 10.2.1.0-17sv - Password Reset
Maturity: poc
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Affected systems
Sonicwall6 products
- sma_200_firmware≤ 9.0.0.10-28sv | ≥ 10.2.0.0, ≤ 10.2.0.7-34sv | ≥ 10.2.1.0, ≤ 10.2.1.0-17sv
- sma_210_firmware≤ 9.0.0.10-28sv | ≥ 10.2.0.0, ≤ 10.2.0.7-34sv | ≥ 10.2.1.0, ≤ 10.2.1.0-17sv
- sma_400_firmware≤ 9.0.0.10-28sv | ≥ 10.2.0.0, ≤ 10.2.0.7-34sv | ≥ 10.2.1.0, ≤ 10.2.1.0-17sv
- sma_410_firmware≤ 9.0.0.10-28sv | ≥ 10.2.0.0, ≤ 10.2.0.7-34sv | ≥ 10.2.1.0, ≤ 10.2.1.0-17sv
- sma_500v_firmware≤ 9.0.0.10-28sv | ≥ 10.2.0.0, ≤ 10.2.0.7-34sv | ≥ 10.2.1.0, ≤ 10.2.1.0-17sv
1 vendor · 6 products
References
2 links- packetstormsecurity.com/files/164564/SonicWall-SMA-10.2.1.0-17sv-Password-Reset.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry