What’s Vulnerable › Vulnerabilities

CVE-2021-20034

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 81.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-09-27 · updated 2026-06-17
• Weakness: CWE-284

Description

An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.

Affected products

• SonicWall Sma 200 Firmware: through 9.0.0.10-28sv; from 10.2.0.0 through 10.2.0.7-34sv; from 10.2.1.0 through 10.2.1.0-17sv
• SonicWall Sma 210 Firmware: through 9.0.0.10-28sv; from 10.2.0.0 through 10.2.0.7-34sv; from 10.2.1.0 through 10.2.1.0-17sv
• SonicWall Sma 400 Firmware: through 9.0.0.10-28sv; from 10.2.0.0 through 10.2.0.7-34sv; from 10.2.1.0 through 10.2.1.0-17sv
• SonicWall Sma 410 Firmware: through 9.0.0.10-28sv; from 10.2.0.0 through 10.2.0.7-34sv; from 10.2.1.0 through 10.2.1.0-17sv
• SonicWall Sma 500V: through 9.0.0.10-28sv; from 10.2.0.0 through 10.2.0.7-34sv; from 10.2.1.0 through 10.2.1.0-17sv

References

• http://packetstormsecurity.com/files/164564/SonicWall-SMA-10.2.1.0-17sv-Password-Reset.html
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0021
• http://packetstormsecurity.com/files/164564/SonicWall-SMA-10.2.1.0-17sv-Password-Reset.html
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0021

Get alerted when CVE-2021-20034 or the next vulnerability affects your stack