CVE-2021-20038: SonicWall SMA 100 appliances stack buffer overflow in mod_cgi

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityRemote unauthenticated code execution on an internet-facing remote access appliance, listed in CISA KEV with known ransomware use and near-maximum EPSS.

What it is

A stack-based buffer overflow in the Apache httpd mod_cgi module of SonicWall SMA 100 series appliances lets a remote unauthenticated attacker overwrite memory via crafted environment variables. The flaw affects SMA 200, 210, 400, 410 and 500v firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier. Because the appliance is an internet-facing remote access gateway, successful exploitation is severe.

Impact

An attacker can execute code as the 'nobody' user on the appliance, gaining a foothold on a perimeter device that brokers remote access. From there, an attacker could pivot into internal networks or tamper with VPN and authentication services.

Attack surface

Reachable over the network through the appliance's web interface with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The vulnerable path is the mod_cgi handling of environment variables in the Apache httpd server.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-01-28 with a 2022-02-11 remediation due date and flags known ransomware campaign use. EPSS is 0.99912 (99.967th percentile), and public exploit code is referenced (badblood, Rapid7).

What to do

• Apply the SonicWall firmware updates referenced in vendor advisory SNWLID-2021-0026 for all affected SMA 100 series models.
• If patching cannot be done immediately, remove or restrict internet exposure of the SMA management and user interfaces to trusted networks.
• Enable multi-factor authentication and review local accounts on the appliance for unauthorized changes.
• Monitor SonicWall advisories and CISA KEV guidance for follow-up fixes, since this CVE was disclosed alongside related SMA 100 flaws.
• Treat the appliance as untrusted until verified clean, and rebuild or reimage if compromise is suspected.

Detection

• Review appliance and web server logs for malformed or unusually long CGI requests and environment-variable abuse against mod_cgi endpoints.
• Hunt for unexpected processes or outbound connections originating from the SMA appliance, especially under the 'nobody' account.
• Check for unauthorized configuration changes, new accounts, or altered VPN and authentication settings on the device.
• Correlate appliance logs with network telemetry for post-exploitation activity consistent with ransomware staging.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.