CVE-2021-20040 — Vulnetix

Try Vulnetix Request Demo

CVE-2021-20040 PUBLISHED CVSS 7.5 HIGH

A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages or files as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

EPSS 8.81% · 92.5th percentile

Risk Scores

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Score

8.81%

92.5th percentile

Affected Products

Vendor	Product	Versions
sonicwall	sma_410_firmware	10.2.1.1-19sv, 10.2.0.8-37sv
sonicwall	sma_200_firmware	10.2.0.8-37sv, 10.2.1.1-19sv
sonicwall	sma_500v_firmware	10.2.0.8-37sv, 10.2.1.1-19sv
sonicwall	sma_400_firmware	10.2.1.1-19sv, 10.2.0.8-37sv
sonicwall	sma_210_firmware	10.2.1.1-19sv, 10.2.0.8-37sv
SonicWall	SonicWall SMA100	10.2.0.8-37sv and earlier, 10.2.1.2-24sv and earlier, 10.2.1.1-19sv and earlier

Timeline

Dec 8, 2021 CVE Published
Dec 9, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Jan 12, 2022 PoC Published
Feb 4, 2022 EPSS Score
Mar 27, 2022 EPSS Score
May 20, 2022 EPSS Score
Jul 13, 2022 EPSS Score
Sep 6, 2022 EPSS Score
Dec 23, 2022 EPSS Score
Feb 15, 2023 EPSS Score
Mar 7, 2023 EPSS Score

References

Open in Interactive Console →