Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
MediumCISA KEVExploited in the wildPublic exploit

OS Command Injection in SonicWall SMA100 Management Interface

IdentifiersCVE-2021-20035CWE-78· Improper Neutralization of Special…

CVE-2021-20035 is an operating system command injection vulnerability in the management interface of SonicWall Secure Mobile Access (SMA) 100 series appliances. SonicWall describes the issue as improper neutralization of special elements in the SMA100 management interface, allowing a remote authenticated attacker to inject arbitrary OS commands. The injected commands execute in the context of the 'nobody' user. SonicWall later updated its advisory to note that the issue may lead not only to denial of service but also to potential code execution. Reported affected products include SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v. Affected firmware branches include 9.0.0.10-28sv and earlier, 10.2.0.7-34sv and earlier, and 10.2.1.0-17sv and earlier.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an authenticated remote attacker to execute arbitrary operating system commands on the appliance as the low-privileged 'nobody' user. This can result in unauthorized command execution on the device, potential service disruption or denial of service, and may enable further post-exploitation activity depending on local privilege boundaries and appliance configuration. SonicWall and downstream reporting indicate the impact assessment was revised from potential DoS to potential code execution, and the vulnerability has been confirmed as exploited in the wild.

Mitigation

If you can’t patch tonight, do this now.

The provided content states there are no available workarounds for CVE-2021-20035. If immediate patching is not possible, only general exposure-reduction steps can be inferred: restrict access to the SMA management interface to trusted administrative networks, minimize remote exposure, and monitor for signs of compromise. However, these measures do not remediate the flaw; firmware upgrade is the required corrective action based on the available information.

Remediation

Patch, then assume compromise.

Upgrade affected SonicWall SMA100 appliances to a fixed firmware release. Reported fixed versions are 9.0.0.11-31sv and higher, 10.2.0.8-37sv and higher, and 10.2.1.1-19sv and higher. Administrators should identify all affected SMA 100 series devices, validate current firmware branch/version, apply the appropriate vendor-provided update, and verify successful installation. Because the vulnerability is known exploited, remediation should be prioritized on any internet-reachable or externally accessible management deployments.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
SonicwallSma 200 Firmwareoperating_system
SonicwallSma 210 Firmwareoperating_system
SonicwallSma 400 Firmwareoperating_system
SonicwallSma 410 Firmwareoperating_system
SonicwallSma 500vapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware1

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity20

Community discussion across Reddit, Mastodon, and other social sources.