CVE-2021-20034: SonicWall SMA 200 Firmware

Critical severity, CVSS 9.1. EPSS: 81% chance of exploitation in the next 30 days.

An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.

Affected products

• SonicWall SMA 200 Firmware: up to and including 9.0.0.10-28sv; from 10.2.0.0, up to and including 10.2.0.7-34sv; from 10.2.1.0, up to and including 10.2.1.0-17sv
• SonicWall SMA 210 Firmware: up to and including 9.0.0.10-28sv; from 10.2.0.0, up to and including 10.2.0.7-34sv; from 10.2.1.0, up to and including 10.2.1.0-17sv
• SonicWall SMA 400 Firmware: up to and including 9.0.0.10-28sv; from 10.2.0.0, up to and including 10.2.0.7-34sv; from 10.2.1.0, up to and including 10.2.1.0-17sv
• SonicWall SMA 410 Firmware: up to and including 9.0.0.10-28sv; from 10.2.0.0, up to and including 10.2.0.7-34sv; from 10.2.1.0, up to and including 10.2.1.0-17sv
• SonicWall SMA 500v: up to and including 9.0.0.10-28sv; from 10.2.0.0, up to and including 10.2.0.7-34sv; from 10.2.1.0, up to and including 10.2.1.0-17sv

Published 2021-09-27. Last modified 2026-06-17.