CVE-2021-20039

PoC —

CVSS 3.1

8.8 high

EPSS

79%p100

Published

Dec 8, 2021 (Dec 8, 2021)

Modified

Jun 17, 2026

Description

Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

Vendors: sonicwall
Products: sma 200 firmware, sma 210 firmware, sma 410 firmware, sma 400 firmware, sma 500v firmware
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (78.7%)

In the news7 stories

SonicWall SMA devices persistently infected with stealthy OVERSTEP backdoor and rootkit

Help Net SecurityAug 5, 15:29 UTC · Aug 5, 2025Malware CVE-2021-20035 CVE-2021-20039 CVE-2024-38475+1 CVEs

UNC6148 Backdoors Fully-Patched SonicWall SMA 100 Series Devices with OVERSTEP Rootkit

The Hacker NewsJul 26, 11:34 UTC · Jul 26, 2025Vulnerability CVE-2021-20035 CVE-2021-20038 CVE-2021-20039+2 CVEs

SonicWall customers hit by fresh, ongoing attacks targeting fully patched SMA 100 devices

CyberScoopJul 16, 17:52 UTC · Jul 16, 2025Vulnerability in the wildCVE-2021-20038 CVE-2024-38475 CVE-2021-20035+2 CVEs

CVE-2021-20039

In the news7 stories

SonicWall SMA devices persistently infected with stealthy OVERSTEP backdoor and rootkit

UNC6148 Backdoors Fully-Patched SonicWall SMA 100 Series Devices with OVERSTEP Rootkit

SonicWall customers hit by fresh, ongoing attacks targeting fully patched SMA 100 devices

Google spots tailored backdoor malware aimed at SonicWall appliances

Google finds custom backdoor being installed on SonicWall network devices

SonicWall Urges Customers to Immediately Patch Critical SMA 100 Flaws

SonicWall strongly urges customers to apply patches to SMA 100 devices