CRITICAL🇵🇱 Wersja polska

CVE-2021-20042

CVSS 9.8v3.1pub. 2021-12-08upd. 2024-11-21

An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Sonicwall Sma 200

    HW
    Sonicwall
    all versions

  • Sonicwall Sma 200 Firmware

    OS
    Sonicwall
    10.2.0.8-37sv10.2.1.1-19sv9.0.0.11-31sv

  • Sonicwall Sma 210

    HW
    Sonicwall
    all versions

  • Sonicwall Sma 210 Firmware

    OS
    Sonicwall
    10.2.0.8-37sv10.2.1.1-19sv9.0.0.11-31sv

  • Sonicwall Sma 400

    HW
    Sonicwall
    all versions

  • Sonicwall Sma 400 Firmware

    OS
    Sonicwall
    10.2.0.8-37sv10.2.1.1-19sv9.0.0.11-31sv

  • Sonicwall Sma 410

    HW
    Sonicwall
    all versions

  • Sonicwall Sma 410 Firmware

    OS
    Sonicwall
    10.2.0.8-37sv10.2.1.1-19sv9.0.0.11-31sv

  • Sonicwall Sma 500v

    HW
    Sonicwall
    all versions

  • Sonicwall Sma 500v Firmware

    OS
    Sonicwall
    10.2.0.8-37sv10.2.1.1-19sv9.0.0.11-31sv
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Firewall
CWE
References

Related vulnerabilities

CVE-2024-38475CRITICAL9.1⚠ KEVPL ✓same product

Apache HTTP Server mod_rewrite — ujawnienie kodu i RCE poprzez błędne escapowanie

CVE-2021-20038CRITICAL9.8⚠ KEVPL ✓same product

Stack-based buffer overflow w SonicWall SMA 100 — zdalny RCE bez uwierzytelnienia

CVE-2021-20028CRITICAL9.8⚠ KEVPL ✓same product

SQL Injection w urządzeniach SonicWall SRA/SMA — zdalne przejęcie kontroli

CVE-2021-20016CRITICAL9.8⚠ KEVPL ✓same product

SQL Injection w SonicWall SMA100 SSLVPN — dostęp do danych bez uwierzytelnienia

CVE-2025-40599CRITICAL9.1PL ✓same product

SonicWall SMA 100 — nieautoryzowany upload pliku prowadzący do RCE