CVE-2021-20035
Published 2021-09-27 · Updated 2026-06-17 · Source PSIRT@sonicwall.com
Summary
CVE-2021-20035 is a medium-severity (CVSS 6.5) vulnerability in SonicWall SMA100 Appliances. CISA added it to the Known Exploited Vulnerabilities catalog on April 16, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by May 7, 2025. CISA does not currently list it as used in ransomware campaigns. SonicWall has 19 vulnerabilities in the KEV catalog, 13 of them linked to ransomware.
All 19 known-exploited SonicWall vulnerabilities →Description
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CISA Known-Exploited Vulnerability
Product: SonicWall — SMA100 Appliances
Name: SonicWall SMA100 Appliances OS Command Injection Vulnerability
Date added: 2025-04-16 · Due: 2025-05-07
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.