by Kastro
Paper/Archive/CVE-2021-20034

CVE-2021-20034

SonicWall SMA100 — An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delet…

EPSS 82%CVSS 9.1
critical.is priorityof 100
47
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 99.6.996 × 2019.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.

Affected

ProductAffectedFixed inSource
SMA1009.0.0.10-28sv and earlier–CNA
SMA10010.2.0.7-34sv and earlier–CNA
SMA10010.2.1.0-17sv and earlier–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

refpsirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0021refpacketstormsecurity.com/files/164564/SonicWall-SMA-10.2.1.0-17sv-Password-Reset.html