CVE-2021-20039
08.12.2021, 10:15
Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
| Vendor | Product | Version |
|---|---|---|
| sonicwall | sma_200_firmware | 9.0.0.11-31sv |
| sonicwall | sma_200_firmware | 10.2.0.8-37sv |
| sonicwall | sma_200_firmware | 10.2.1.1-19sv |
| sonicwall | sma_210_firmware | 9.0.0.11-31sv |
| sonicwall | sma_210_firmware | 10.2.0.8-37sv |
| sonicwall | sma_210_firmware | 10.2.1.1-19sv |
| sonicwall | sma_410_firmware | 9.0.0.11-31sv |
| sonicwall | sma_410_firmware | 10.2.0.8-37sv |
| sonicwall | sma_410_firmware | 10.2.1.1-19sv |
| sonicwall | sma_400_firmware | 9.0.0.11-31sv |
| sonicwall | sma_400_firmware | 10.2.0.8-37sv |
| sonicwall | sma_400_firmware | 10.2.1.1-19sv |
| sonicwall | sma_500v_firmware | 9.0.0.11-31sv |
| sonicwall | sma_500v_firmware | 10.2.0.8-37sv |
| sonicwall | sma_500v_firmware | 10.2.1.1-19sv |
𝑥
= Vulnerable software versions
References