CVE-2021-20035: SonicWall SMA100 Appliances OS Command Injection Vulnerability

Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2025-04-16. EPSS: 4.2% chance of exploitation in the next 30 days.

Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.

Affected products

• SonicWall SMA 200 Firmware: before 9.0.0.11-31sv (fixed in 9.0.0.11-31sv); from 10.2.0.0, before 10.2.0.8-37sv (fixed in 10.2.0.8-37sv); from 10.2.1.0, before 10.2.1.1-19sv (fixed in 10.2.1.1-19sv)
• SonicWall SMA 210 Firmware: before 9.0.0.11-31sv (fixed in 9.0.0.11-31sv); from 10.2.0.0, before 10.2.0.8-37sv (fixed in 10.2.0.8-37sv); from 10.2.1.0, before 10.2.1.1-19sv (fixed in 10.2.1.1-19sv)
• SonicWall SMA 400 Firmware: before 9.0.0.11-31sv (fixed in 9.0.0.11-31sv); from 10.2.0.0, before 10.2.0.8-37sv (fixed in 10.2.0.8-37sv); from 10.2.1.0, before 10.2.1.1-19sv (fixed in 10.2.1.1-19sv)
• SonicWall SMA 410 Firmware: before 9.0.0.11-31sv (fixed in 9.0.0.11-31sv); from 10.2.0.0, before 10.2.0.8-37sv (fixed in 10.2.0.8-37sv); from 10.2.1.0, before 10.2.1.1-19sv (fixed in 10.2.1.1-19sv)
• SonicWall SMA 500v: before 9.0.0.11-31sv (fixed in 9.0.0.11-31sv); from 10.2.0.0, before 10.2.0.8-37sv (fixed in 10.2.0.8-37sv); from 10.2.1.0, before 10.2.1.1-19sv (fixed in 10.2.1.1-19sv)

Published 2021-09-27. Last modified 2026-06-17.