CVE-2021-20042

—

CVSS 3.1

9.8 critical

EPSS

3%p84

Published

Dec 8, 2021 (Dec 8, 2021)

Modified

Jun 17, 2026

Description

An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

Vendors: sonicwall
Products: sma 200 firmware, sma 210 firmware, sma 410 firmware, sma 400 firmware, sma 500v firmware
Weakness: CWE-441
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.6%)

In the news2 stories

SonicWall Urges Customers to Immediately Patch Critical SMA 100 Flaws

The Hacker NewsDec 9, 05:18 UTC · Dec 9, 2021Vulnerability in the wildCVE-2021-20038 CVE-2021-20039 CVE-2021-20040+5 CVEs

SonicWall strongly urges customers to apply patches to SMA 100 devices

Security AffairsDec 8, 20:08 UTC · Dec 8, 2021Vulnerability CVE-2021-20038 CVE-2021-20045 CVE-2021-20039+5 CVEs