DaystoPatch

SonicWallExploited incident

SonicWall SMA 100 management interface command injection (2021 bug exploited in 2025)

CVE-2021-20035High, CVSS 7.2In CISA's Known Exploited Vulnerabilities catalog since 16 Apr 2025

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
0h
First public report to first vendor statement
Exposure
0h
First public report to first fix
Follow-through
0h
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    SonicWall PSIRT SNWLID-2021-0022 (PSIRT API record)CuratedQuote verified

    "published_when":"2021-09-23T21:29:13Z"

    Disclosed with fixes in 2021; SonicWall flagged exploitation on 2025-04-14 (revision 1.1).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6e12560290d3d8a4…
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    SonicWall advisory SNWLID-2021-0022ClaimedQuote verified23 Sep 2021, 21:29 UTC

    Authenticated SMA100 Arbitrary Command Injection Vulnerability

    The vendor's own disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6e12560290d3d8a4…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2021-20035ClaimedQuote verified27 Sep 2021, 17:20 UTC

    Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b1d81a778dd6288c…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2021-20035)ClaimedQuote verified16 Apr 2025

    SonicWall SMA100 Appliances OS Command Injection Vulnerability

    Added to CISA's KEV catalog on 2025-04-16.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet16 Apr 2025, 17:15 UTC

    CVE-2021-20035

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    SonicWall advisory SNWLID-2021-0022ClaimedQuote verified

    Authenticated SMA100 Arbitrary Command Injection Vulnerability

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6e12560290d3d8a4…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    SonicWall PSIRT SNWLID-2021-0022 (PSIRT API record)CuratedQuote verified23 Sep 2021, 21:29 UTC

    "published_when":"2021-09-23T21:29:13Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6e12560290d3d8a4…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    at disclosure

    SonicWall PSIRT SNWLID-2021-0022 (PSIRT API record)CuratedQuote verified

    10.2.1.1-19sv and higher

    Fixed firmware for all three lines listed in the advisory; revisions in April 2025 changed only the comment, summary and CVSS. Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6e12560290d3d8a4…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    at disclosure

    SonicWall PSIRT SNWLID-2021-0022 (PSIRT API record)CuratedQuote verified

    9.0.0.11-31sv and higher

    Fixes for 10.2.1, 10.2.0 and 9.0.0 lines.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6e12560290d3d8a4…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. SNWLID-2021-0022

    Recorded in the revision history

    created_when: 2021-09-23T21:29:13Z

    CVSS base vector changed from AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H to AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (score 5.5 to 7.2).

    • Severity
    CVSS vector
    BeforeAV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
    AfterAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    Verbatim wording. Removed text is struck through. Added text is bold.
    Before

    d Injection Vulnerability published_when: 2021-09-23T21:29:13Z last_updated_when: 2025-04-14T17:58:18Z impact: medium cvss: 5.5 cvss_vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H cvss_version: 3.0 cwe: CWE-78 cve: CVE-2021-20035 cpe: summary: Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as

    After

    and Injection Vulnerability published_when: 2021-09-23T21:29:13Z last_updated_when: 2025-04-15T15:50:44Z impact: high cvss: 7.2 cvss_vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H cvss_version: 3.0 cwe: CWE-78 cve: CVE-2021-20035 cpe: summary: Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as

    Earlier version captured 15 Apr 2025, 02:02 UTC: archived copyLater version captured 17 Apr 2025, 07:25 UTC: archived copyRecovered from archived copiesSnapshots 0c822d4ed0… and 5d043a71b9…Incident page

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • SMA 100 Series (SMA 200, 210, 400, 410, 500v)
How we built this timeline

Revision history: v1.0 23-Sep-2021 initial release; v1.1 14-Apr-2025 'potentially being exploited in the wild'; v1.2 15-Apr-2025 summary updated (now allows code execution) and CVSS raised to 7.2. KEV 16 Apr 2025.

Requires authentication. Fix predates exploitation by years, so exploited before a fix is false.

Related

SonicWall report card