Critical Arbitrary File Delete Vulnerability In SonicWall SMA 100 Series Appliances [CVE-2021-20034]

CVE number – CVE-2021-20034

A critical vulnerability in SonicWall SMA 100 series appliances, which includes SMA 200, 210, 400, 410 and 500v, could potentially allow a remote unauthenticated attacker the ability to delete arbitrary files from a SMA 100 series appliance and potentially gain administrator access to the device.

The vulnerability is due to an improper limitation of a file path to a restricted directory potentially leading to arbitrary file deletion as ‘nobody.’

SonicWall strongly urges that organizations follow the guidance below to patch SMA 100 series products, which include SMA 200, 210, 400, 410 and 500v.

Impacted PlatformsImpacted Versions
 SMA 100 Series
(SMA 200, 210, 400, 410, 500v)
 10.2.1.0-17sv and earlier10.2.0.7-34sv and earlier9.0.0.10-28sv and earlier

Organizations using SMA 100 series appliances should immediately log in to MySonicWall.com to upgrade their appliances to the patched firmware versions. For upgrade assistance, please reference the KB article, “How to Upgrade Firmware on SMA 100 Series Appliances”  or contact SonicWall support.

FIXED SOFTWARE

ProductPlatformImpacted VersionFixed Version
SMA 100 Series• SMA 200
• SMA 210
• SMA 400
• SMA 410
• SMA 500v (ESX, KVM, AWS, Azure)
10.2.1.0-17sv and earlier

10.2.0.7-34sv and earlier

9.0.0.10-28sv and earlier
10.2.1.1-19sv and higher

10.2.0.8-37sv and higher

9.0.0.11-31sv and higher

Jason Davies

UK based technology professional, with an interest in computer security and telecoms.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: