Vulnerability record · CVE-2021-20034 · published 27 September 2021
CVE-2021-20034: SonicWall SMA100 improper access control enables unauthenticated file deletion
Sonicwall · Sma 200 Firmware
SonicWall SMA100 appliances contain an improper access control flaw that lets a remote unauthenticated attacker bypass path traversal checks and delete arbitrary files. Deleting certain files can force the device to reboot to factory default settings, wiping configuration and disrupting remote access.
Description
An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Automated analysis
critical priorityCVSS 9.1 with network reachability, no authentication, and high integrity/availability impact, plus very high EPSS and a public exploit reference.
What it is
SonicWall SMA100 appliances contain an improper access control flaw that lets a remote unauthenticated attacker bypass path traversal checks and delete arbitrary files. Deleting certain files can force the device to reboot to factory default settings, wiping configuration and disrupting remote access.
Impact
An attacker can delete arbitrary files on the appliance, causing a factory reset that erases configuration and takes the device offline. No data confidentiality impact is described; the effect is integrity and availability loss.
Attack surface
Reachable over the network via the SMA100 web interface with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The flaw is in path traversal validation on file operations.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.81, 99.6th percentile) and a public Packet Storm exploit reference exists, indicating active interest and likely weaponization.
What to do
- Apply the SonicWall PSIRT advisory SNWLID-2021-0021 firmware update for the affected SMA100 models.
- Restrict management and web interface access to trusted networks or VPN only.
- Back up SMA100 configurations offline so a factory reset can be recovered quickly.
- Monitor SMA100 appliances for unexpected reboots or configuration resets.
- Review logs for anomalous path traversal patterns in HTTP requests.
Detection
- Alert on HTTP requests containing path traversal sequences (../, encoded variants) to SMA100 endpoints.
- Monitor for unexpected factory reset events or configuration loss on SMA100 devices.
- Track file deletion or reboot syslog entries on SMA100 appliances.
- Correlate unauthenticated requests to file-handling endpoints with subsequent device restarts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://packetstormsecurity.com/files/164564/SonicWall-SMA-10.2.1.0-17sv-Password-Reset.html | ExploitThird Party AdvisoryVDB Entry |
| https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0021 | Vendor Advisory |
| http://packetstormsecurity.com/files/164564/SonicWall-SMA-10.2.1.0-17sv-Password-Reset.html | ExploitThird Party AdvisoryVDB Entry |
| https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0021 | Vendor Advisory |
Track CVE-2021-20034 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-20034), CISA KEV, FIRST EPSS (scores of 2026-09-25). This page is refreshed as NVD updates the record.
