CVE-2021-20035
SonicWall SMA100 Appliances OS Command Injection Vulnerability
Description
CVE-2021-20035 is a medium-severity OS command injection vulnerability in the SonicWall SMA100 series management interface. The flaw allows a remote authenticated attacker to inject arbitrary commands as the 'nobody' user, potentially leading to a denial-of-service (DoS) condition on the appliance. With a CVSS v3.1 score of 6.5 (MEDIUM), this vulnerability requires low-level authentication but is otherwise easily exploitable over the network. Despite being disclosed in 2021, CISA added CVE-2021-20035 to the Known Exploited Vulnerabilities catalog in April 2025, indicating renewed or persistent exploitation activity. The EPSS score of 3.97% at the 88.15th percentile confirms that this vulnerability continues to be actively targeted.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sonicwall | sma 200 firmware | < 9.0.0.11-31sv; >= 10.2.0.0, < 10.2.0.8-37sv; >= 10.2.1.0, < 10.2.1.1-19sv |
| sonicwall | sma 210 firmware | < 9.0.0.11-31sv; >= 10.2.0.0, < 10.2.0.8-37sv; >= 10.2.1.0, < 10.2.1.1-19sv |
| sonicwall | sma 400 firmware | < 9.0.0.11-31sv; >= 10.2.0.0, < 10.2.0.8-37sv; >= 10.2.1.0, < 10.2.1.1-19sv |
| sonicwall | sma 410 firmware | < 9.0.0.11-31sv; >= 10.2.0.0, < 10.2.0.8-37sv; >= 10.2.1.0, < 10.2.1.1-19sv |
| sonicwall | sma 500v | < 9.0.0.11-31sv; >= 10.2.0.0, < 10.2.0.8-37sv; >= 10.2.1.0, < 10.2.1.1-19sv |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20035(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2021-20035 is classified under CWE-78 (OS Command Injection), a weakness where the application constructs OS commands using user-controlled input without proper neutralization of special characters. In the SonicWall SMA100 management interface, authenticated user input is incorporated into system commands without adequate sanitization, allowing attackers to inject additional commands that execute with the privileges of the 'nobody' user on the underlying operating system.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command
Impact Analysis
CVE-2021-20035 has a CVSS v3.1 base score of 6.5 (MEDIUM) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The vulnerability is remotely exploitable (AV:N) with low complexity (AC:L), requires only low-level privileges (PR:L), and needs no user interaction (UI:N). Availability (High) is the primary impact, as the injected commands can disrupt SMA100 appliance operations, causing denial of service that affects all VPN users relying on the device. Unlike other SonicWall SMA command injection vulnerabilities (such as CVE-2023-44221 which requires admin privileges), CVE-2021-20035 only requires low-level authentication, significantly expanding the pool of potential attackers to include any authenticated user, not just administrators. While the CVSS vector indicates no direct confidentiality or integrity impact, the command execution as the 'nobody' user could potentially be leveraged for information gathering or as a stepping stone for further attacks depending on the system configuration. The EPSS score of 4.0% at the 88.1th percentile indicates a significant probability of exploitation.
Exploit Maturity
CVE-2021-20035 was originally disclosed in 2021 but was added to CISA's Known Exploited Vulnerabilities catalog in April 2025 with a remediation deadline of May 7, 2025, indicating that exploitation activity has persisted or resurged over four years after the initial disclosure. The SonicWall PSIRT advisory (SNWLID-2021-0022) provides official vendor details. The EPSS score of 4.0% at the 88.1th percentile indicates a significant probability of exploitation. SonicWall SMA appliances remain a persistent target for threat actors due to their role as network perimeter devices providing VPN access. The long gap between initial disclosure and KEV inclusion suggests that unpatched appliances continue to be discovered and exploited in the wild, highlighting the importance of maintaining firmware updates on network security appliances even for older vulnerabilities.
Remediation
-
Apply SonicWall firmware updates immediately. Upgrade SMA 200, 210, 400, 410, and 500v appliances to patched firmware versions: 9.0.0.11-31sv or later, 10.2.0.8-37sv or later, or 10.2.1.1-19sv or later, depending on the firmware branch. Consult the SonicWall PSIRT advisory SNWLID-2021-0022 for version-specific guidance.
-
Restrict management interface access. Ensure the SMA100 management interface is not accessible from the internet. Place the management interface on a dedicated management network with strict access controls limiting connectivity to authorized administrator workstations.
-
Audit user accounts and access. Review all user accounts on SMA100 appliances, remove unnecessary accounts, and enforce strong authentication. Since this vulnerability requires only low-level privileges, any compromised user account could be leveraged for exploitation.
-
Implement monitoring and alerting. Configure logging and monitoring for unusual command execution patterns, unexpected process creation, or abnormal resource consumption on SMA appliances that could indicate exploitation of this or similar command injection vulnerabilities.
-
Consider appliance replacement for EOL devices. If SMA100 appliances are running firmware versions that are no longer receiving security updates, plan for replacement with current-generation devices that receive active security support.
Technical Details
CVE-2021-20035 is an OS command injection vulnerability in the SonicWall SMA100 management interface. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates a network-accessible attack with low complexity requiring only low-level authentication, with high impact on availability.
The vulnerability exists in the management interface's handling of user input in certain administrative functions. When an authenticated user interacts with specific management interface features, the application incorporates user-supplied data into operating system commands without properly neutralizing special characters such as semicolons, pipes, or command substitution sequences. The injected commands execute as the 'nobody' user, which has limited system privileges but is sufficient to disrupt appliance operations and potentially access certain system files. The CVSS vector reflects no confidentiality or integrity impact, suggesting the primary exploitable outcome is service disruption through resource exhaustion or process termination. Affected firmware versions span three major branches: versions prior to 9.0.0.11-31sv, versions 10.2.0.0 through 10.2.0.7-34sv, and versions 10.2.1.0 through 10.2.1.0-17sv. The fixes implement proper input sanitization to prevent shell metacharacter injection.
Frequently Asked Questions
Is CVE-2021-20035 being actively exploited?
Yes. CISA added CVE-2021-20035 to the Known Exploited Vulnerabilities catalog in April 2025, confirming active exploitation more than four years after the initial disclosure. The EPSS score of 3.97% at the 88.15th percentile confirms ongoing exploitation activity.
What products are affected by CVE-2021-20035?
SonicWall SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v appliances running firmware versions prior to 9.0.0.11-31sv, 10.2.0.8-37sv, or 10.2.1.1-19sv are affected.
How do I fix CVE-2021-20035?
Upgrade SMA100 firmware to version 9.0.0.11-31sv, 10.2.0.8-37sv, or 10.2.1.1-19sv or later depending on your firmware branch. Restrict management interface access to trusted networks and audit all user accounts.
How severe is CVE-2021-20035?
CVE-2021-20035 has a CVSS v3.1 score of 6.5 (MEDIUM) with primary impact on availability. While it requires authentication, only low-level privileges are needed, and the vulnerability can cause denial of service on the SMA appliance, disrupting VPN access for all connected users.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.