CVE-2021-20045

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 25.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-08 · updated 2026-06-17
Weakness: CWE-120

Description

A buffer overflow vulnerability in SMA100 sonicfiles RAC_COPY_TO (RacNumber 36) method allows a remote unauthenticated attacker to potentially execute code as the 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

Affected products

SonicWall Sma 200 Firmware: 10.2.0.8-37sv, 10.2.1.1-19sv
SonicWall Sma 210 Firmware: 10.2.0.8-37sv, 10.2.1.1-19sv
SonicWall Sma 400 Firmware: 10.2.0.8-37sv, 10.2.1.1-19sv
SonicWall Sma 410 Firmware: 10.2.0.8-37sv, 10.2.1.1-19sv
SonicWall Sma 500V Firmware: 10.2.0.8-37sv, 10.2.1.1-19sv

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026

Get alerted when CVE-2021-20045 or the next vulnerability affects your stack