CVE-2021-20049: sonicwall sma_100_firmware Observable Response Discrepancy

Vulnerability summary

CVE-2021-20049 is a high (CVSS 7.5) Observable Response Discrepancy vulnerability in sonicwall sma_100_firmware. EPSS estimates a 1.39% chance of exploitation in the next 30 days, higher than 71.8% of scored vulnerabilities.

Timeline

1. 23-12-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x versions.

• CWE-204Observable Response DiscrepancyThe product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
• CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.