CVE-2021-20042

high-risk

Published 2021-12-08

An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

Do I need to act?

0.88% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (15)

Sma 200 Firmware

Sma 210 Firmware

Sma 410 Firmware

Sma 400 Firmware

Sma 500V Firmware

Affected Vendors

Sonicwall

References (2)

Vendor Advisory https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026

/ 100

high-risk

Severity 32/34 · Critical

Exploitability 3/34 · Minimal

Exposure 18/34 · Moderate