Published: 08/12/2021 Updated: 01/04/2022

CVSS v2 Base Score: 9 | Impact Score: 10 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 801

Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C

Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated malicious user to inject arbitrary commands as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sonicwall sma_200_firmware 9.0.0.11-31sv
sonicwall sma_200_firmware 10.2.0.8-37sv
sonicwall sma_200_firmware 10.2.1.1-19sv
sonicwall sma_210_firmware 9.0.0.11-31sv
sonicwall sma_210_firmware 10.2.0.8-37sv
sonicwall sma_210_firmware 10.2.1.1-19sv
sonicwall sma_410_firmware 9.0.0.11-31sv
sonicwall sma_410_firmware 10.2.0.8-37sv
sonicwall sma_410_firmware 10.2.1.1-19sv
sonicwall sma_400_firmware 9.0.0.11-31sv
sonicwall sma_400_firmware 10.2.0.8-37sv
sonicwall sma_400_firmware 10.2.1.1-19sv
sonicwall sma_500v_firmware 9.0.0.11-31sv
sonicwall sma_500v_firmware 10.2.0.8-37sv
sonicwall sma_500v_firmware 10.2.1.1-19sv

This Metasploit module exploits an authenticated command injection vulnerability in the SonicWall SMA 100 series web interface Exploitation results in command execution as root The affected versions are 10212-24sv and below, 10208-37sv and below, and 90011-31sv and below ...

SonicWall SMA-100 Unauth RCE Exploit (CVE-2021-20038)

Bad Blood Bad Blood is an exploit for CVE-2021-20038, a stack-based buffer overflow in the httpd binary of SMA-100 series systems using firmware versions 1021x I've written a lot of the technical details here: AttackerKB CVE-2021-20038 The exploit, as written, will open up a telnet bind shell on port 1270 An attacker that connects to the shell will achieve execution

CWE-78 https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026 http://packetstormsecurity.com/files/165563/SonicWall-SMA-100-Series-Authenticated-Command-Injection.html https://nvd.nist.gov https://github.com/jbaines-r7/badblood https://packetstormsecurity.com/files/165563/SonicWall-SMA-100-Series-Authenticated-Command-Injection.html

CVE-2021-20039

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect