SonicWall SMA100 flaw enables admin takeover
A critical file-deletion vulnerability in SonicWall SMA100 appliances can let remote attackers gain administrator privileges; patch immediately.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2021-20038 as exploited in the wild.
The Information-technology Promotion Agency, Japan (IPA) issued an advisory regarding a vulnerability in SonicWall's SMA100 series, a line of remote-access appliances. The flaw allows a remote, unauthenticated attacker to delete arbitrary files on the device, which can ultimately be leveraged to obtain administrator-level privileges over the appliance.
SonicWall has assigned the issue a CVSSv3.0 score of 9.1, reflecting the severity of potential impact should the vulnerability be exploited. IPA notes that the vendor has stated this is a high-impact vulnerability and urges affected organizations to apply the available patched versions as soon as possible. End-of-life product lines will not receive a security patch, and IPA advises administrators to confirm patch availability and applicability directly with SonicWall.
No evidence of active exploitation is cited in the advisory, and no specific threat actors, malware, or campaigns are associated with this vulnerability at the time of publication. The advisory is primarily a call to action for organizations running SMA100 appliances to update to vendor-supplied fixed versions promptly.
Mentioned in this report
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/alert20211001.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs