Rewterz Threat Advisory – Multiple SonicWall SMA 100 Series Devices Vulnerabilities

Severity

High

Analysis Summary

CVE-2021-20045 

SonicWall SMA devices is vulnerable to a buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system.

CVE-2021-20044 

An unspecified error in SonicWall SMA devices could allow a remote authenticated attacker to execute commands on the system.

CVE-2021-20043 

SonicWall SMA devices is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by getBookmarks method. A remote authenticated attacker could overflow a buffer and execute arbitrary code on the system.

CVE-2021-20042 

SonicWall SMA devices could allow a remote attacker to bypass security restrictions. An attacker could exploit this vulnerability to bypass firewall rules.

CVE-2021-20041 

SonicWall SMA devices is vulnerable to a denial of service, caused by an infinite loop. A remote attacker could exploit this vulnerability to cause a denial of service.

CVE-2021-20040 

SonicWall SMA devices could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to the upload function containing “dot dot” sequences (/../) to upload arbitrary files on the system.

CVE-2021-20039 

SonicWall SMA devices could allow a remote authenticated attacker to execute arbitrary <code/commands> on the system, caused by a flaw in /cgi-bin/viewcert. An attacker could exploit this vulnerability to execute arbitrary commands on the system.

CVE-2021-20038 

SonicWall SMA 100 Series devices is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the Apache httpd server’s mod_cgi module environment variables. By sending a specially-crafted request, a remote attacker could overflow a buffer and execute arbitrary code as nobody user in the appliance.

Impact

• Buffer Overflow
• Command Execution
• Security Bypass
• Denial of Services
• Unauthorized Access

Affected Vendors

• Sonicwall

Affected Products

• SonicWall SMA100 9.0.0.3
• SonicWall SMA100 9.0.0.4
• SonicWall SMA100 appliance 10.2.0.2-20sv
• SonicWall SMA100 10.2.0.5
• SonicWall SMA 200 9.0.0.10-28sv
• SonicWall SMA 200 10.2.0.7-34sv
• SonicWall SMA 200 10.2.1.0-17sv
• SonicWall SMA 210 9.0.0.10-28sv
• SonicWall SMA 210 10.2.0.7-34sv
• SonicWall SMA 210 10.2.1.0-17sv
• SonicWall SMA 400 9.0.0.10-28sv
• SonicWall SMA 400 10.2.0.7-34sv
• SonicWall SMA 400 10.2.1.0-17sv
• SonicWall SMA 410 9.0.0.10-28sv
• SonicWall SMA 410 10.2.0.7-34sv
• SonicWall SMA 410 10.2.1.0-17sv
• SonicWall SMA 500v 9.0.0.10-28sv
• SonicWall SMA 500v 10.2.0.7-34sv
• SonicWall SMA 500v 10.2.1.0-17sv
• SonicWall SMA 100 Series 10.2.1.0-17sv

Remediation

Refer to SonicWall Security Advisory for patch, upgrade or suggested workaround information.