CVE-2021-20038

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.999 · 100 %ileexploit · PoCEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 3 exploits · PoC

Likely / severe?

99.9% (100th) EPSS

CVSS 7.5 · high

Is it mine?

37 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · fstec_bdu

added 2022-01-28remediate by 2022-02-11

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-22

SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-121USCWE-121USCWE-787USCWE-787US

exploits (3)

Public proof-of-concept and weaponised exploit code.

anir0y/sonicwall-audit-toolkitSonicWall security audit toolkit with vulnerable CTF lab (CVE-2021-20038, CVE-2024-53704)PoC · poc_in_github
jbaines-r7/badbloodSonicWall SMA-100 Unauth RCE Exploit (CVE-2021-20038)PoC · poc_in_github
vesperp/CVE-2021-20038-SonicWall-RCEvesperp/CVE-2021-20038-SonicWall-RCEPoC · poc_in_github

affected products (37)

Products and version ranges known to be affected.

SonicWall SonicWall SMA100≤ 10.2.0.8-37sv and earlierenisa_euvdEU
SonicWall SonicWall SMA100≤ 10.2.1.1-19sv and earlierenisa_euvdEU
SonicWall SonicWall SMA100≤ 10.2.1.2-24sv and earlierenisa_euvdEU
Apache Software Foundation HTTP Serverall versionsfstec_bduRU
SonicWall SMA 100≤ 10.2.1.1-19svfstec_bduRU
SonicWall SMA 100≤ 10.2.0.8-37svfstec_bduRU
SonicWall SMA 100≤ 10.2.1.2-24svfstec_bduRU
SonicWall SMA 200≤ 10.2.1.1-19svfstec_bduRU
SonicWall SMA 200≤ 10.2.0.8-37svfstec_bduRU
SonicWall SMA 200≤ 10.2.1.2-24svfstec_bduRU
SonicWall SMA 210≤ 10.2.1.2-24svfstec_bduRU
SonicWall SMA 210≤ 10.2.1.1-19svfstec_bduRU
SonicWall SMA 210≤ 10.2.0.8-37svfstec_bduRU
SonicWall SMA 400≤ 10.2.1.2-24svfstec_bduRU
SonicWall SMA 400≤ 10.2.0.8-37svfstec_bduRU
SonicWall SMA 400≤ 10.2.1.1-19svfstec_bduRU
SonicWall SMA 410≤ 10.2.1.2-24svfstec_bduRU
SonicWall SMA 410≤ 10.2.1.1-19svfstec_bduRU
SonicWall SMA 410≤ 10.2.0.8-37svfstec_bduRU
SonicWall SMA 500v≤ 10.2.1.2-24svfstec_bduRU

showing 20 of 37

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu NVD CVE.org MITRE

published 2021-12-08modified 2026-06-17

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan