SonicWall SMA 100 Unauthenticated Stack Overflow RCE
- Product
- SonicWall SMA 100 series (200/210/400/410/500v)
- CVE
- CVE-2021-20038
- Disclosed
- 2021-12-07
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- SMA 100 series 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier.
- Fixed
- 10.2.0.9-41sv, 10.2.1.3-27sv.
Summary
A stack-based buffer overflow in the SMA 100 Apache httpd allowed unauthenticated remote code execution as the nobody user. Rapid7 published a detailed analysis and the bug was later exploited in the wild.
Root cause
The SMA's modified Apache mod_cgi builds CGI environment variables by concatenating request data into a fixed-size stack buffer without bounds checks. A long request value overflows the buffer, and the lack of stack canaries makes control-flow hijacking practical.
Impact
Unauthenticated code execution on the VPN appliance.
Detection
Version-check SMA firmware; look for httpd crashes. Nuclei template CVE-2021-20038.
Mitigation
Upgrade to fixed firmware.