CVE-2021-20049

moderate-risk

Published 2021-12-23

A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x versions.

Do I need to act?

0.33% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (18)

Sma 100 Firmware

Sma 200 Firmware

Sma 210 Firmware

Sma 400 Firmware

Sma 410 Firmware

Sma 500V Firmware

Affected Vendors

Sonicwall

References (2)

Vendor Advisory https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0030

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 1/34 · Minimal

Exposure 19/34 · Moderate