CVE-2021-20038: SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability

Vulnerability summary

CVE-2021-20038 is a critical (CVSS 9.8) Stack-based Buffer Overflow vulnerability in SonicWall SMA 100 Appliances. It is known to be exploited: CISA lists it, first on 28-01-2022. It has been used in ransomware campaigns. EPSS estimates a 99.91% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 08-12-2021
   PublishedVulnerability first disclosed.
2. 28-01-2022
   Added to CISA KEVSonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability
3. 11-02-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.