CVE-2021-20041

—

CVSS 3.1

7.5 high

EPSS

7%p93

Published

Dec 8, 2021 (Dec 8, 2021)

Modified

Jun 17, 2026

Description

An unauthenticated and remote adversary can consume all of the device's CPU due to crafted HTTP requests sent to SMA100 /fileshare/sonicfiles/sonicfiles resulting in a loop with unreachable exit condition. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

Vendors: sonicwall
Products: sma 200 firmware, sma 210 firmware, sma 410 firmware, sma 400 firmware, sma 500v firmware
Weakness: CWE-835
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (6.6%)

In the news2 stories

SonicWall Urges Customers to Immediately Patch Critical SMA 100 Flaws

The Hacker NewsDec 9, 05:18 UTC · Dec 9, 2021Vulnerability in the wildCVE-2021-20038 CVE-2021-20039 CVE-2021-20040+5 CVEs

SonicWall strongly urges customers to apply patches to SMA 100 devices

Security AffairsDec 8, 20:08 UTC · Dec 8, 2021Vulnerability CVE-2021-20038 CVE-2021-20045 CVE-2021-20039+5 CVEs