CVE-2021-20038
CriticalExploitedPublic exploitA Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance.
Published Jan 26, 2022 · Updated Oct 21, 2025 · Also known as TR-22-0006, TR-22-0087
Key Facts
Patch immediately- CVE-2021-20038 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Sma 200 Firmware (Sonicwall), Sma 210 Firmware (Sonicwall), Sma 400 Firmware (Sonicwall) and 3 more products.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jan 28, 2022 and is known to be used in ransomware campaigns. Public exploit code is available.
- EPSS estimates a 100% probability of exploitation in the next 30 days.
- No fixed version is listed yet; check the vendor advisory for mitigations.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
100%
Higher than 99.9% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings, used by ransomware
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2021-20038 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Jan 28, 2022 | Feb 11, 2022 | Known |
| Industry KEV feed | Jan 28, 2022 | Feb 11, 2022 | Known |
| CIRCL KEV | Jan 28, 2022 | Feb 11, 2022 | Known |
| ENISA EUVD | Jan 28, 2022 | n/a | Not reported |
Required action: Apply updates per vendor instructions.
Affected Products
16 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Sma 200 FirmwareSonicwall | 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv | n/a |
| Sma 210 FirmwareSonicwall | 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv | n/a |
| Sma 400 FirmwareSonicwall | 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv | n/a |
| Sma 410 FirmwareSonicwall | 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv | n/a |
| Sma 500v FirmwareSonicwall | 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv | n/a |
Timeline
Publicly disclosed
Jan 26, 2022
Added to CISA KEV
Jan 28, 2022
Added to Industry KEV feed
Jan 28, 2022
Added to CIRCL KEV
Jan 28, 2022
Added to ENISA EUVD
Jan 28, 2022
Last updated
Oct 21, 2025
Weakness Type
- CWE-121 Stack-based Buffer Overflow
- CWE-787 Out-of-bounds Write
References
- advisoryhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026
- advisoryhttps://securityaffairs.co/
- advisoryhttps://securityaffairs.co/wordpress/125400/security/sonicwall-sma-100-devices-flaws.html
- advisoryhttps://threatpost.com/critical-sonicwall-vpn-bugs-appliance-takeover/176869/
- advisoryhttps://us-cert.cisa.gov/ncas/current-activity/2021/12/08/sonicwall-releases-security-advisory-sma-100-series-appliances
FAQ
Common Questions.
A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance.
Affected: Sma 200 Firmware (Sonicwall) versions 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv; Sma 210 Firmware (Sonicwall) versions 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv; Sma 400 Firmware (Sonicwall) versions 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv, among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jan 28, 2022 and is known to be used in ransomware campaigns.
Yes. It was added on Jan 28, 2022 with a federal remediation due date of Feb 11, 2022.
Public exploit code is available.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2021-20038 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo