CVSS: 7.8EPSS: 0%CPEs: 20EXPL: 0CVE-2021-20041
https://notcve.org/view.php?id=CVE-2021-20041
An unauthenticated and remote adversary can consume all of the device's CPU due to crafted HTTP requests sent to SMA100 /fileshare/sonicfiles/sonicfiles resulting in a loop with unreachable exit condition. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances. Un adversario no autenticado y remoto puede consumir toda la CPU del dispositivo debido a peticiones HTTP diseñadas enviadas a SMA100 /fileshare/sonicfiles/sonicfiles, lo que provoca un bucle con condición de salida inalcanzable. Esta vulnerabilidad afecta a los dispositivos SMA 200, 210, 400, 410 y 500v • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 0CVE-2021-20040
https://notcve.org/view.php?id=CVE-2021-20040
A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages or files as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances. Una vulnerabilidad de salto de ruta relativo en la función upload de SMA100 permite a un atacante remoto no autenticado cargar páginas web o archivos diseñados como usuario "nobody". Esta vulnerabilidad afecta a los dispositivos SMA 200, 210, 400, 410 y 500v • https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •
CVSS: 9.0EPSS: 67%CPEs: 20EXPL: 2CVE-2021-20039 – SonicWall SMA 100 Series Authenticated Command Injection
https://notcve.org/view.php?id=CVE-2021-20039
Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances. Una neutralización inapropiada de elementos especiales en el método http POST de la interfaz de administración de SMA100 "/cgi-bin/viewcert" permite a un atacante remoto autenticado inyectar comandos arbitrarios como usuario "nobody". Esta vulnerabilidad afecta a los dispositivos SMA 200, 210, 400, 410 y 500v • http://packetstormsecurity.com/files/165563/SonicWall-SMA-100-Series-Authenticated-Command-Injection.html https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/sonicwall_cve_2021_20039.rb • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 95%CPEs: 20EXPL: 3CVE-2021-20038 – SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2021-20038
A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions. Una vulnerabilidad de desbordamiento de búfer en la región Stack de la memoria en las variables de entorno del módulo mod_cgi del servidor httpd de SMA100 permite a un atacante remoto no autenticado ejecutar potencialmente código como usuario "nobody" en el dispositivo. Esta vulnerabilidad afecta a los dispositivos SMA 200, 210, 400, 410 y 500v con firmware versiones 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv y versiones anteriores SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution. • https://github.com/vesperp/CVE-2021-20038-SonicWall-RCE https://github.com/jbaines-r7/badblood https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026 https://www.rapid7.com/blog/post/2022/01/11/cve-2021-20038-42-sonicwall-sma-100-multiple-vulnerabilities-fixed-2 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •