Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Network
0

CVE-2021-20043

Disclosure Date: December 08, 2021
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

A Heap-based buffer overflow vulnerability in SonicWall SMA100 getBookmarks method allows a remote authenticated attacker to potentially execute code as the nobody user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
8.8 High
Impact Score:
5.9
Exploitability Score:
2.8
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • sonicwall

Products

  • sma 200 firmware 10.2.0.8-37sv,
  • sma 200 firmware 10.2.1.1-19sv,
  • sma 210 firmware 10.2.0.8-37sv,
  • sma 210 firmware 10.2.1.1-19sv,
  • sma 400 firmware 10.2.0.8-37sv,
  • sma 400 firmware 10.2.1.1-19sv,
  • sma 410 firmware 10.2.0.8-37sv,
  • sma 410 firmware 10.2.1.1-19sv,
  • sma 500v firmware 10.2.0.8-37sv,
  • sma 500v firmware 10.2.1.1-19sv

Additional Info

Technical Analysis