Critical 9.8Known exploited (CISA KEV)Published Dec 8, 2021

CVE-2021-20038A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' use…

Updated under an hour ago (Oct 27, 2026, 7:50 PM ET)

Does this affect you?

It affects SonicWall SMA100 and 5 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Jan 28, 2022; federal agencies had to remediate by Feb 11, 2022, and it is known to be used in ransomware. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for SonicWall SMA100

Exploited in the last 30 days

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.

CVSS: 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-121
Known exploited: Added to CISA KEV Jan 28, 2022; federal remediation due Feb 11, 2022; known ransomware useApply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 99.91% (percentile 100)
Assigned by: sonicwall
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

SonicWall SonicWall SMA100 sonicwall:sma100 (from the name)	10.2.0.8-37sv and earlier; 10.2.1.1-19sv and earlier; 10.2.1.2-24sv and earlier	CNA record
sonicwall sma_200_firmware sonicwall:sma_200_firmware	10.2.0.8-37sv; 10.2.1.1-19sv; 10.2.1.2-24sv	NVD
sonicwall sma_210_firmware sonicwall:sma_210_firmware	10.2.0.8-37sv; 10.2.1.1-19sv; 10.2.1.2-24sv	NVD
sonicwall sma_410_firmware sonicwall:sma_410_firmware	10.2.0.8-37sv; 10.2.1.1-19sv; 10.2.1.2-24sv	NVD
sonicwall sma_400_firmware sonicwall:sma_400_firmware	10.2.0.8-37sv; 10.2.1.1-19sv; 10.2.1.2-24sv	NVD
sonicwall sma_500v_firmware sonicwall:sma_500v_firmware	10.2.0.8-37sv; 10.2.1.1-19sv; 10.2.1.2-24sv	NVD

References

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026	x-refsource-confirm, vendor-advisory
https://github.com/jbaines-r7/badblood	x-refsource-misc, exploit, third-party-advisory
https://www.rapid7.com/blog/post/2022/01/11/cve-2021-20038-42-sonicwall-sma-100-multiple-vulnerabilities-fixed-2/	x-refsource-misc, exploit, third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20038	us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.