ACTIEF MISBRUIKT
CVE-2021-20035: SonicWall SMA100 Appliances OS Command Injection Vulnerability
| Leverancier | SonicWall |
|---|---|
| Product | SMA100 Appliances |
| Actief misbruikt | Ja |
| Toegevoegd aan CISA KEV | 16 apr 2025 |
| CISA-deadline (Amerikaanse overheid) | 7 mei 2025 |
| Zwakte (CWE) | CWE-78 |
Vereiste actie (tekst van CISA, Engels)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Beschrijving (NVD, Engels)
SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.
BRONNEN
Andere lekken bij SonicWall
- CVE-2026-19868: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
- CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability
- CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
- CVE-2026-15410: SonicWall SMA1000 Appliances Code Injection Vulnerability
- CVE-2026-15409: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
Gegevens van NVD, CISA KEV, FIRST EPSS en adviezen van leveranciers. Bijgewerkt 10 nov 2026.