SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability (CVE-2021-20038)

What is affected, what to do

An unauthenticated attacker can execute code on SonicWall SMA 100 devices due to a stack-based buffer overflow in the mod_cgi module of the SMA100 Apache httpd server. This affects firmware versions 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv, and earlier. The vulnerability is actively exploited in ransomware campaigns. Affected products include SMA 200, 210, 400, 410, and 500v appliances. Immediate patching to the latest firmware version is critical.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• SonicWall SMA100 eq 10.2.0.8-37sv and earlier..10.2.0.8-37sv and earlier
• SonicWall SMA100 eq 10.2.1.1-19sv and earlier..10.2.1.1-19sv and earlier
• SonicWall SMA100 eq 10.2.1.2-24sv and earlier..10.2.1.2-24sv and earlier

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Locate every SonicWall SMA 200, 210, 400, 410 and 500v and confirm its firmware in the admin UI. Vulnerable releases are 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier.
   • Patch: A firmware fix is available from the vendor. Look up the fixed release in the SonicWall PSIRT advisory. Retire or disconnect older 9.x and EOL units that cannot receive the fix.
   • Cut exposure now: If you cannot patch within hours, restrict the portal and management interface (typically TCP/443, or your custom HTTPS port) to known source ranges on the upstream firewall. If necessary, take the appliance offline temporarily.
   • Check for compromise before patching: Preserve the config, logs and active session list as a forensic copy. Patching does not evict persistence an attacker has already planted.
   • Rotate credentials: If the device was exposed while unpatched, reset local SMA accounts, admin passwords, LDAP/AD bind service accounts and the passwords of VPN users who authenticated through the portal. Enforce MFA on the SMA.
   • Escalate: Assess the incident against your NIS2 reporting obligations. If you find indicators of compromise, the early warning to BSI or your national CSIRT is due within 24 h.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Place the SMA in a dedicated DMZ. Allow egress only to defined internal targets (AD, file servers, published hosts). Block and log internet-bound egress from the appliance, which would carry reverse shells or tool downloads.
   • WAF/IPS: Deploy an upstream rule that drops requests to /cgi-bin/ with oversized query strings or headers. The exploit depends on very long environment-variable content, and a length cap of a few hundred bytes will not break legitimate portal traffic. Enable vendor signatures for CVE-2021-20038 in your Suricata/Snort or NGFW IPS feeds.
   • Rate limiting: Public exploits brute-force ASLR with many repeated requests. Per-source request throttling on the SMA portal raises the cost of exploitation substantially.
   • IAM / least privilege: Limit the SMA's LDAP bind account to read-only, and never use a Domain Admin for it. Trim the resources reachable through the SMA to what users actually need.
   • Configuration: Disable admin access on the WAN interface and turn off unused portal features. Forward syslog to an external SIEM, because local logs on a compromised box cannot be trusted.
3. 03

   Runbook step 3

   Detection rules

   • Web / reverse-proxy logs: Hunt for /cgi-bin/ requests with abnormally long URIs. Example SPL: index=proxy dest=<sma_ip> uri_path="/cgi-bin/*" | where len(uri_query)>500 | stats count by src_ip. Also look for high request bursts from a single source.
   • Appliance stability: Repeated httpd crashes or restarts and 5xx spikes in SMA syslog are the footprint of ASLR brute-forcing. Turn this into a Sigma threshold rule on httpd restart events per 10 min.
   • Network telemetry (Zeek/Suricata): Alert on new outbound connections from the SMA IP to the internet, especially on odd ports or with interactive-session patterns. An example is conn.log where id.orig_h == <sma_ip> and the external destination is not on the allowlist.
   • Lateral movement: Review logons sourced from the SMA IP or its VPN address pool against internal hosts (Windows EID 4624 logon type 3/10, bursts of EID 4625). Also look for unusual LDAP queries by the bind account and off-hours VPN sessions.
   • Integrity: Diff the exported config against a known-good baseline. New local users, altered bookmarks, unknown admin sessions or scripts in writable paths (running as nobody) all indicate compromise.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog

Vendors and products

• SonicWall Sma 200 Firmware
• SonicWall Sma 210 Firmware
• SonicWall Sma 400 Firmware
• SonicWall Sma 410 Firmware
• SonicWall Sma 500v Firmware
• SonicWall Sonicwall Sma100

Weakness classes (CWE)

• CWE-121Stack-based Buffer Overflow

  Variant

  A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

  Entry at MITRE CWE-121

References & sources

• psirt.global.sonicwall.comvuln-detail/SNWLID-2021-0026x_refsource_CONFIRM, Vendor advisory
• github.comjbaines-r7/badbloodx_refsource_MISC, Exploit, Third-party advisory
• rapid7.comblog/post/2022/01/11/cve-2021-20038-42-sonicwall-sma-100-multip…x_refsource_MISC, Exploit, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20038government-resource, US government resource