CVE-2021-20035: SonicWall SMA100 management interface OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is confirmed exploited per CISA KEV and affects internet-facing management interfaces, though it requires authentication and the documented impact is limited to DoS.

What it is

The SMA100 management interface fails to neutralize special elements, letting a remote authenticated attacker inject arbitrary commands that run as the 'nobody' user. The flaw is rated CVSS 6.5 (Medium) with high availability impact, and CISA added it to the Known Exploited Vulnerabilities catalog in April 2025, so it is being exploited in the wild.

Impact

An attacker with valid credentials can execute arbitrary commands on the appliance as the low-privileged 'nobody' user, with the primary documented effect being denial of service. The CVSS vector shows no confidentiality or integrity impact, so the record supports availability loss rather than data theft or full takeover.

Attack surface

Reachable over the network through the SMA100 management interface (AV:N) with low privileges required (PR:L) and no user interaction (UI:N). The attacker must already hold authenticated access to the management interface.

Exploitation

CISA added this CVE to the KEV catalog on 2025-04-16 with a remediation due date of 2025-05-07, confirming known exploitation; EPSS gives a 30-day probability of about 4.2 percent (90th percentile). No ransomware campaign use is documented.

What to do

• Apply the SonicWall vendor fix per advisory SNWLID-2021-0022 as the first action.
• If patching is not immediately possible, follow CISA KEV required action and BOD 22-01 guidance, or discontinue use of the affected appliance.
• Restrict management interface access to trusted administrative networks and disable internet-facing exposure.
• Enforce least privilege and strong unique credentials for management accounts, and audit for unnecessary accounts.
• Monitor vendor advisories for updated mitigation instructions.

Detection

• Review SMA100 management interface logs for unexpected command execution or process activity under the 'nobody' account.
• Alert on anomalous or malformed input to management interface endpoints that could carry injected commands.
• Monitor for availability degradation or restart patterns on SMA100 appliances consistent with DoS.
• Correlate authentication events with subsequent suspicious management activity from the same source.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.