HIGH🇵🇱 Wersja polska

CVE-2021-20049

CVSS 7.5v3.1pub. 2021-12-23upd. 2024-11-21

A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x versions.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Sonicwall Sma100

    HW
    Sonicwall
    all versions

  • Sonicwall Sma 100 Firmware

    OS
    Sonicwall
    10.2.0.8-37sv10.2.1.2-24sv< 10.0.0.0

  • Sonicwall Sma200

    HW
    Sonicwall
    all versions

  • Sonicwall Sma 200 Firmware

    OS
    Sonicwall
    10.2.0.8-37sv10.2.1.2-24sv< 10.0.0.0

  • Sonicwall Sma210

    HW
    Sonicwall
    all versions

  • Sonicwall Sma 210 Firmware

    OS
    Sonicwall
    10.2.0.8-37sv10.2.1.2-24sv< 10.0.0.0

  • Sonicwall Sma400

    HW
    Sonicwall
    all versions

  • Sonicwall Sma 400 Firmware

    OS
    Sonicwall
    10.2.0.8-37sv10.2.1.2-24sv< 10.0.0.0

  • Sonicwall Sma410

    HW
    Sonicwall
    all versions

  • Sonicwall Sma 410 Firmware

    OS
    Sonicwall
    10.2.0.8-37sv10.2.1.2-24sv< 10.0.0.0

  • Sonicwall Sma500v

    HW
    Sonicwall
    all versions

  • Sonicwall Sma 500v Firmware

    OS
    Sonicwall
    10.2.0.8-37sv10.2.1.2-24sv< 10.0.0.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2024-38475CRITICAL9.1⚠ KEVPL ✓same product

Apache HTTP Server mod_rewrite — ujawnienie kodu i RCE poprzez błędne escapowanie

CVE-2021-20038CRITICAL9.8⚠ KEVPL ✓same product

Stack-based buffer overflow w SonicWall SMA 100 — zdalny RCE bez uwierzytelnienia

CVE-2021-20028CRITICAL9.8⚠ KEVPL ✓same product

SQL Injection w urządzeniach SonicWall SRA/SMA — zdalne przejęcie kontroli

CVE-2021-20016CRITICAL9.8⚠ KEVPL ✓same product

SQL Injection w SonicWall SMA100 SSLVPN — dostęp do danych bez uwierzytelnienia

CVE-2025-40599CRITICAL9.1PL ✓same product

SonicWall SMA 100 — nieautoryzowany upload pliku prowadzący do RCE