CVE-2021-20035
SonicWall SMA100 Appliances OS Command Injection Vulnerability
Published Sep 27, 2021 · updated Jun 16, 2026 · sonicwall sma 200 firmware
SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.
Timeline
Detection, updates, and resolution for this record.
Sep 27, 2021 · Catalog
Detected
SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.
Apr 16, 2025 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
May 7, 2025 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date May 7, 2025
Affected
- cpe sonicwall/sma 200 firmwareversion unspecified
- cpe sonicwall/sma 210 firmwareversion unspecified
- cpe sonicwall/sma 400 firmwareversion unspecified
- cpe sonicwall/sma 410 firmwareversion unspecified
- cpe sonicwall/sma 500vversion unspecified
- vendor SonicWall SMA100 Appliancesversion unspecified
Sources
- CISA KEVCVE-2021-20035
SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.
cisa.gov - CVE.orgCVE-2021-20035
Official CVE identifier
cve.org - FIRST EPSSCVE-2021-20035
30-day exploitation probability 4.2%
first.org - NIST NVDCVE-2021-20035
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.
nvd.nist.gov