SonicWall has verified and patched vulnerabilities of critical and\r\nmedium severity (CVSS 5.3-9.8) in SMA 100 series appliances, which include SMA 200,\r\n210, 400, 410 and 500v products. SMA 100 series appliances with WAF enabled are\r\nalso impacted by the majority of these vulnerabilities.
SonicWall strongly urges that organizations follow the guidance below\r\nto patch SMA 100 series products, which include SMA 200, 210, 400, 410 and 500v\r\nproducts.
\r\n\r\n\r\n\r\n\r\n\r\n
| \r\n Issue\r\n ID | \r\n \r\n Summary | \r\n \r\n CVE | \r\n \r\n CVSS | \r\n \r\n Reporting Party | \r\n
| \r\n SMA-3217 | \r\n \r\n Unauthenticated\r\n Stack-Based Buffer Overflow | \r\n \r\n CVE-2021-20038 | \r\n \r\n 9.8 | \r\n \r\n Rapid7 | \r\n
| \r\n SMA-3204 | \r\n \r\n Authenticated\r\n Command Injection | \r\n \r\n CVE-2021-20039 | \r\n \r\n 7.2 | \r\n \r\n Rapid7 | \r\n
| \r\n SMA-3206 | \r\n \r\n Unauthenticated\r\n File Upload Path Traversal | \r\n \r\n CVE-2021-20040 | \r\n \r\n 6.5 | \r\n \r\n Rapid7\r\n |NCCGroup | \r\n
| \r\n SMA-3207 | \r\n \r\n Unauthenticated\r\n CPU Exhaustion | \r\n \r\n CVE-2021-20041 | \r\n \r\n 7.5 | \r\n \r\n Rapid7 | \r\n
| \r\n SMA-3208 | \r\n \r\n Unauthenticated\r\n Confused Deputy | \r\n \r\n CVE-2021-20042 | \r\n \r\n 6.3 | \r\n \r\n Rapid7 | \r\n
| \r\n SMA-3231 | \r\n \r\n Heap-Based\r\n Buffer Overflow | \r\n \r\n CVE-2021-20043 | \r\n \r\n 8.8 | \r\n \r\n NCCGroup | \r\n
| \r\n SMA-3233 | \r\n \r\n Post-Authentication\r\n Remote Command Execution | \r\n \r\n CVE-2021-20044 | \r\n \r\n 7.2 | \r\n \r\n NCCGroup | \r\n
| \r\n SMA-3235 | \r\n \r\n Multiple\r\n Unauthenticated Heap-Based and Stack Based Buffer Overflow | \r\n \r\n CVE-2021-20045 | \r\n \r\n 9.4 | \r\n \r\n NCCGroup | \r\n
A critical severity vulnerability\r\n(CVSS 9.8) in SMA 100 appliances, which includes SMA 200, 210, 400, 410 and\r\n500v could allow a remote unauthenticated attacker to cause Stack-based Buffer\r\nOverflow and would result in code execution as the nobody user in the SMA100\r\nappliance. It\r\nwas noticed that the SMA 100 users with licensed/enabled WAF are impacted by\r\nthis vulnerability.
The Vulnerability is due to the SonicWall\r\nSMA SSLVPN Apache httpd server GET method of mod_cgi module environment\r\nvariables use a single stack-based buffer using `strcat`. This allows remote attacker to\r\ncause Stack-based Buffer Overflow and would result in code execution.
There is no evidence that this\r\nvulnerability is being exploited in the wild.
SonicWall strongly urges that\r\norganizations follow the guidance below to patch SMA 100 series products, which\r\ninclude SMA 200, 210, 400, 410 and 500v.
IMPACT:
As outlined in SNWLID-2021-0026,\r\nsuccessfully leveraging CVE-2021-20038 against\r\nimpacted SMA 100 devices can result in the remote attacker being able to initiate the stack based buffer overflow which can potentially lead to code execution in the device.
| \r\n Impacted\r\n Platforms | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv | \r\n
A high severity vulnerability (CVSS 7.2)\r\nin SMA 100 appliances, which includes SMA 200, 210, 400, 410 and 500v could\r\nallow remote unauthenticated attacker to execute arbitrary commands in the SMA\r\n100 appliance as root user. This can potentially lead to the remote\r\nauthenticated attacker taking over the control of the SMA 100 appliance\r\nremotely. It was noticed that the SMA 100 users with licensed/enabled WAF are\r\nnot impacted by this vulnerability.
The Vulnerability is due to the SonicWall\r\nSMA SSLVPN `/cgi-bin/viewcert` POST http method which allows authenticated\r\nindividuals to upload, view, or delete SSL certificates. A remote authenticated\r\nattacker can execute arbitrary commands using this POST http method.
There is no evidence that this\r\nvulnerability is being exploited in the wild.
SonicWall strongly urges that\r\norganizations follow the guidance below to patch SMA 100 series products, which\r\ninclude SMA 200, 210, 400, 410 and 500v.
IMPACT:
As outlined in SNWLID-2021-0026,\r\nsuccessfully leveraging CVE-2021-20039 against\r\nimpacted SMA 100 devices can result in the remote authenticated attacker\r\nexecuting arbitrary commands in the SMA 100 appliance as root user resulting in\r\nthe remote takeover of the device.
| \r\n Impacted\r\n Platforms | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 9.0.0.11-31sv, 10.2.0.8-37sv, 10.2.1.1-19sv | \r\n
A medium severity vulnerability\r\n(CVSS 6.5) in SMA 100 appliances, which includes SMA 200, 210, 400, 410 and\r\n500v could allow remote unauthenticated attacker to upload arbitrary files.\r\nAttacker can upload crafted web pages to the web server's root directory or\r\nmalicious files to any directory in the appliance as a nobody user. It was observed that SMA 100\r\ndevices with WAF licensed/enabled are also impacted by this vulnerability.
This is due to the Path Traversal\r\nAttack Vulnerability. The Path traversal attacks vulnerability in SMA100 shares\r\nfunctionality that allows remote unauthenticated attacker to upload arbitrary\r\nfiles to any directory in the appliance.
There is no evidence that this vulnerability is being\r\nexploited in the wild.
SonicWall strongly urges that organizations follow the\r\nguidance below to patch SMA 100 series products, which include SMA 200, 210,\r\n400, 410 and 500v.
IMPACT:
As outlined in SNWLID-2021-0026,\r\nsuccessfully leveraging CVE-2021-20040 against\r\nimpacted SMA 100 devices can allow the remote unauthenticated attacker to\r\nupload arbitrary files. The attacker can upload crafted web pages to the\r\nweb server's root directory or malicious files to any directory in the\r\nappliance.
| \r\n Impacted\r\n Platforms | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.0.8-37sv, 10.2.1.1-19sv | \r\n
4. Security Notice:
SMA-3207 - SMA 100 Series Unauthenticated CPU Exhaustion Vulnerability (CVSS\r\n7.5)
A high severity vulnerability (CVSS 7.5) in SMA 100\r\nappliances, which includes SMA 200, 210, 400, 410 and 500v could allow an\r\nunauthenticated and remote adversary to consume all of the device’s CPU\r\npotentially causing DoS. It was observed that the SMA100 appliances with WAF\r\nlicensed/enabled are also impacted by this vulnerability.
The CPU exhaustion is due to the crafted HTTP requests sent\r\nto https://address/fileshare/sonicfiles/sonicfiles` resulting in an infinite\r\nloop in the `fileexplorer` process.
There is no evidence that this vulnerability is being\r\nexploited in the wild.
SonicWall strongly urges that organizations follow the\r\nguidance below to patch SMA 100 series products, which include SMA 200, 210,\r\n400, 410 and 500v.
IMPACT:
As outlined in SNWLID-2021-0026, successfully leveraging CVE-2021-20041 against\r\nimpacted SMA 100 devices can allow an unauthenticated and remote adversary to\r\nconsume all of the device’s CPU potentially causing DoS.
| \r\n Impacted\r\n Platforms | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 9.0.0.11-31sv, 10.2.0.8-37sv, 10.2.1.1-19sv | \r\n
5. Security Notice:
SMA-3208 - SMA 100 Series Unauthenticated \"Confused Deputy\"\r\nVulnerability (CVSS 6.3)
A medium severity vulnerability\r\n(CVSS 6.3) in SMA 100 appliances, which includes SMA 200, 210, 400, 410 and\r\n500v could allow a remote unauthenticated attacker to use SMA 100 series\r\ndevices as an \"unintended proxy or intermediary\" (aka Confused Deputy\r\n- see CWE-441). Outside attacker can use the SMA 100 as undetectable proxy to\r\nbypass firewall rules. It was observed that SMA 100 devices with WAF\r\nlicensed/enabled are also impacted by this vulnerability.
There is no evidence that this vulnerability is being\r\nexploited in the wild.
SonicWall strongly urges that organizations follow the\r\nguidance below to patch SMA 100 series products, which include SMA 200, 210,\r\n400, 410 and 500v.
IMPACT:
As outlined in SNWLID-2021-0026,\r\nsuccessfully leveraging CVE-2021-20042 against impacted SMA 100 devices\r\ncan allow the remote unauthenticated attacker to use SMA 100 series devices as\r\nan \"unintended proxy or intermediary\" (aka Confused Deputy - see CWE-441).\r\nThe outside attacker can use the SMA 100 as undetectable\r\nproxy to bypass firewall rules.
| \r\n Impacted\r\n Platforms | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 9.0.0.11-31sv, 10.2.0.8-37sv, 10.2.1.1-19sv | \r\n
6. Security Notice:
SMA-3231 - SMA 100 Series getBookmarks Heap-based Buffer Overflow (CVSS\r\n8.8)
A critical severity vulnerability\r\n(CVSS 8.8) in SMA 100 appliances, which includes SMA 200, 210, 400, 410 and 500v\r\ncould allow a Remote authenticated attacker can cause Heap-based Buffer\r\nOverflow and would result in code execution as the nobody user in the SMA100\r\nappliance. It was observed that the SMA100 appliances with WAF licensed/enabled\r\nare also impacted by this vulnerability.
This Vulnerability is due to the RAC_GET_BOOKMARKS_HTML5\r\n(RacNumber 35) method that allows users to list their bookmarks. This method is\r\nvulnerable to heap-based buffer-overflow, due to unchecked use of strcat. So remote\r\nauthenticated attacker can cause Heap-based Buffer Overflow and would result in\r\ncode execution as the nobody user in the SMA100 appliance.
There is no evidence that this\r\nvulnerability is being exploited in the wild.
SonicWall strongly urges that\r\norganizations follow the guidance below to patch SMA 100 series products, which\r\ninclude SMA 200, 210, 400, 410 and 500v.
IMPACT:
As outlined in SNWLID-2021-0026, successfully leveraging CVE-2021-20043 against impacted SMA 100\r\ndevices can allow a Remote authenticated attacker can cause Heap-based Buffer\r\nOverflow and would result in code execution as the nobody user in the SMA100 appliance.
| \r\n Impacted\r\n Platforms | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.0.8-37sv, 10.2.1.1-19sv | \r\n
7. Security Notice:
SMA-3233 - SMA 100 Series POST-Authentication Remote Code Execution (RCE)\r\n(CVSS 7.2)
A high severity vulnerability\r\n(CVSS 7.2) in SMA 100 appliances, which includes SMA 200, 210, 400, 410 and\r\n500v could allow a Remote authenticated attacker to execute system commands as\r\n‘nobody’, the attacker can modify/delete files in the cgi-bin directory and\r\nalso able to reboot system remotely. It was observed that the SMA100 appliances\r\nwith WAF licensed/enabled are also impacted by this vulnerability.
This Vulnerability is due to an\r\nexposed Management API which is written in Python Flask. Remote authenticated\r\nattacker can execute system commands as ‘nobody’ user in the SMA100 appliance.
There is no evidence that this\r\nvulnerability is being exploited in the wild.
SonicWall strongly urges that\r\norganizations follow the guidance below to patch SMA 100 series products, which\r\ninclude SMA 200, 210, 400, 410 and 500v.
IMPACT:
As outlined in SNWLID-2021-0026,\r\nsuccessfully leveraging CVE-2021-20044 against impacted SMA 100 devices could\r\nallow a Remote authenticated attacker to execute system commands as ‘nobody’,\r\nthe attacker can modify/delete files in the cgi-bin directory and also able to\r\nreboot system remotely.
| \r\n Impacted\r\n Platforms | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.0.8-37sv, 10.2.1.1-19sv | \r\n
8. Security Notice:
SMA-3235 - Multiple SMA 100 Unauthenticated File Explorer Heap-based and\r\nStack-based Buffer Overflows (CVSS 9.4)
A critical severity vulnerability\r\n(CVSS 9.4) in SMA 100 appliances, which includes SMA 200, 210, 400, 410 and\r\n500v could allow a remote unauthenticated attacker to cause Heap-based and\r\nStack-based Buffer Overflow and would result in code execution as the nobody\r\nuser in the SMA100 appliance. It was observed that the SMA100 appliances with\r\nWAF licensed/enabled are also impacted by this vulnerability. Exploitation\r\npotentially leading to code execution.
This Vulnerability is due to the sonicfiles\r\nRAC_COPY_TO (RacNumber 36) method which allows users to upload files to an SMB\r\nshare and can be called without any authentication. RacNumber 36 of the\r\nsonicfiles API maps to the upload_file Python method and this is associated\r\nwith filexplorer binary, which is a custom program written in C++ which is\r\nvulnerable to a number of memory safety issues.
There is no evidence that this\r\nvulnerability is being exploited in the wild.
SonicWall strongly urges that\r\norganizations follow the guidance below to patch SMA 100 series products, which\r\ninclude SMA 200, 210, 400, 410 and 500v.
IMPACT:
As outlined in SNWLID-2021-0026,\r\nsuccessfully leveraging CVE-2021-20045 against impacted SMA 100 devices could\r\nallow a remote unauthenticated attacker to cause Heap-based and Stack-based\r\nBuffer Overflow and would result in code execution as the nobody user in the\r\nSMA100 appliance.
| \r\n Impacted\r\n Platforms | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.0.8-37sv, 10.2.1.1-19sv | \r\n
\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
| \r\n · \r\n Impacted\r\n Platform: SMA 100 Series | \r\n |||||
| \r\n ISSUE\r\n ID | \r\n \r\n Summary\r\n | \r\n \r\n CVSS\r\n Score | \r\n \r\n Impacted\r\n Firmware | \r\n \r\n Fixed\r\n Firmware | \r\n \r\n CVE | \r\n
| \r\n SMA\r\n 3217 | \r\n \r\n Critical\r\n SMA 100 Series Unauthenticated Stack-based Buffer Overflow \r\n \r\n \r\n \r\n \r\n \r\n \r\n | \r\n \r\n 9.8 High | \r\n \r\n 10.2.1.0-17sv \r\n | \r\n \r\n 10.2.1.3-27sv | \r\n \r\n CVE-2021-20038 | \r\n
| \r\n 10.2.1.1-19sv \r\n | \r\n \r\n 10.2.1.3-27sv | \r\n ||||
| \r\n 10.2.1.2-24sv \r\n | \r\n \r\n 10.2.1.3-27sv | \r\n ||||
| \r\n SMA\r\n 3204 | \r\n \r\n SMA 100 Series Authenticated Command\r\n Injection Vulnerability as Root | \r\n \r\n \r\n 7.2\r\n High | \r\n \r\n 9.0.0.11-31sv* | \r\n \r\n 10.2.0.9-41sv\r\n | \r\n \r\n CVE-2021-20039 | \r\n
| \r\n 10.2.0.8-37sv | \r\n \r\n 10.2.0.9-41sv | \r\n ||||
| \r\n 10.2.1.1\r\n -19sv | \r\n \r\n 10.2.1.3-27sv | \r\n ||||
| \r\n SMA\r\n 3206 | \r\n \r\n Unauthenticated File Upload Path Traversal Vulnerability | \r\n \r\n 6.5\r\n Medium | \r\n \r\n 10.2.0.8-37sv | \r\n \r\n \r\n 10.2.0.9-41sv | \r\n \r\n CVE-2021-20040 | \r\n
| \r\n 10.2.1.1\r\n -19sv | \r\n \r\n 10.2.1.3-27sv | \r\n ||||
| \r\n SMA\r\n 3207 | \r\n \r\n Unauthenticated CPU Exhaustion Vulnerability | \r\n \r\n 7.5\r\n High | \r\n \r\n 9.0.0.11-31sv* | \r\n \r\n 10.2.0.9-41sv\r\n | \r\n \r\n CVE-2021-20041 | \r\n
| \r\n \r\n 10.2.0.8-37sv | \r\n \r\n \r\n 10.2.0.9-41sv | \r\n ||||
| \r\n 10.2.1.1\r\n -19sv | \r\n \r\n 10.2.1.3-27sv | \r\n ||||
| \r\n SMA-3208 | \r\n \r\n Unauthenticated \"Confused Deputy\"\r\n Vulnerability | \r\n \r\n 6.3\r\n Medium | \r\n \r\n 9.0.0.11-31sv* | \r\n \r\n 10.2.0.9-41sv\r\n | \r\n \r\n CVE-2021-20042 | \r\n
| \r\n \r\n 10.2.0.8-37sv | \r\n \r\n \r\n 10.2.0.9-41sv | \r\n ||||
| \r\n 10.2.1.1\r\n -19sv | \r\n \r\n 10.2.1.3-27sv | \r\n ||||
| \r\n SMA-3231 | \r\n \r\n getBookmarks\r\n Heap-based Buffer Overflow | \r\n \r\n 8.8\r\n High | \r\n \r\n \r\n 10.2.0.8-37sv | \r\n \r\n \r\n 10.2.0.9-41sv | \r\n \r\n CVE-2021-20043 | \r\n
| \r\n 10.2.1.1\r\n -19sv | \r\n \r\n 10.2.1.3-27sv | \r\n ||||
| \r\n SMA-3233 | \r\n \r\n Post-Authentication Remote Code Execution\r\n (RCE) | \r\n \r\n 7.2\r\n High | \r\n \r\n \r\n 10.2.0.8-37sv | \r\n \r\n \r\n 10.2.0.9-41sv | \r\n \r\n CVE-2021-20044 | \r\n
| \r\n 10.2.1.1\r\n -19sv | \r\n \r\n 10.2.1.3-27sv | \r\n ||||
| \r\n SMA-3235 | \r\n \r\n Multiple SMA 100 Unauthenticated File\r\n Explorer Heap-based and Stack-based Buffer Overflows | \r\n \r\n 9.4\r\n High | \r\n \r\n \r\n 10.2.0.8-37sv | \r\n \r\n \r\n 10.2.0.9-41sv | \r\n \r\n CVE-2021-20045 | \r\n
| \r\n 10.2.1.1 -19sv | \r\n \r\n 10.2.1.3-27sv | \r\n
| \r\n Impacted\r\n Platforms | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 9.0.0.11-31sv* and earlier, 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier | \r\n
| \r\n Impacted\r\n Platforms | \r\n \r\n Fixed\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.0.9-41sv, 10.2.1.3-27sv | \r\n
Jake Baines- Rapid7
Richard Warren - NCCGroup
1.0
07-Dec-2021
Initial Release.
---------------------------------
Version
1.1
Date
08-Dec-2021
Description
Correction - Typo in SMA3217 Impact section, corrected CVEID CVE-2021-20039 to CVE-2021-20038 and made changes 'as root user resulting in the remote takeover of the device' to 'potentially lead to code execution in the device.'
---------------------------------
Version
1.2
Date
21-Apr-2022
Description
Updated summary, removed line 'There is no evidence that these vulnerabilities are being exploited in the wild.' CISAgov has CVE-2021-20038 in their list of routinely exploited vulnerabilities.