Vulnerability Details CVE-2021-20039
Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.537
EPSS Ranking 97.9%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 9.0
Products affected by CVE-2021-20039
-
cpe:2.3:h:sonicwall:sma_200:-
-
cpe:2.3:h:sonicwall:sma_210:-
-
cpe:2.3:h:sonicwall:sma_400:-
-
cpe:2.3:h:sonicwall:sma_410:-
-
cpe:2.3:h:sonicwall:sma_500v:-
-
cpe:2.3:o:sonicwall:sma_200_firmware:10.2.0.8-37sv
-
cpe:2.3:o:sonicwall:sma_200_firmware:10.2.1.1-19sv
-
cpe:2.3:o:sonicwall:sma_200_firmware:9.0.0.11-31sv
-
cpe:2.3:o:sonicwall:sma_210_firmware:10.2.0.8-37sv
-
cpe:2.3:o:sonicwall:sma_210_firmware:10.2.1.1-19sv
-
cpe:2.3:o:sonicwall:sma_210_firmware:9.0.0.11-31sv
-
cpe:2.3:o:sonicwall:sma_400_firmware:10.2.0.8-37sv
-
cpe:2.3:o:sonicwall:sma_400_firmware:10.2.1.1-19sv
-
cpe:2.3:o:sonicwall:sma_400_firmware:9.0.0.11-31sv
-
cpe:2.3:o:sonicwall:sma_410_firmware:10.2.0.8-37sv
-
cpe:2.3:o:sonicwall:sma_410_firmware:10.2.1.1-19sv
-
cpe:2.3:o:sonicwall:sma_410_firmware:9.0.0.11-31sv
-
cpe:2.3:o:sonicwall:sma_500v_firmware:10.2.0.8-37sv
-
cpe:2.3:o:sonicwall:sma_500v_firmware:10.2.1.1-19sv
-
cpe:2.3:o:sonicwall:sma_500v_firmware:9.0.0.11-31sv