CVE-2021-20043

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 23.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-08 · updated 2026-06-17
Weakness: CWE-122

Description

A Heap-based buffer overflow vulnerability in SonicWall SMA100 getBookmarks method allows a remote authenticated attacker to potentially execute code as the nobody user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

Affected products

SonicWall Sma 200 Firmware: 10.2.0.8-37sv, 10.2.1.1-19sv
SonicWall Sma 210 Firmware: 10.2.0.8-37sv, 10.2.1.1-19sv
SonicWall Sma 400 Firmware: 10.2.0.8-37sv, 10.2.1.1-19sv
SonicWall Sma 410 Firmware: 10.2.0.8-37sv, 10.2.1.1-19sv
SonicWall Sma 500V Firmware: 10.2.0.8-37sv, 10.2.1.1-19sv

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026

Get alerted when CVE-2021-20043 or the next vulnerability affects your stack