Loading vulnerability…
CVE-2021-20039 is an authenticated command injection vulnerability in the SonicWall SMA 100 series management interface. The flaw is present in the '/cgi-bin/viewcert' POST handler, where special elements are not properly neutralized, allowing an authenticated remote attacker to inject arbitrary operating system commands. Affected products include SonicWall SMA 200, 210, 400, 410, and 500v appliances. Available reporting characterizes the issue as enabling command execution on the appliance, with some references stating execution occurs as the low-privilege 'nobody' user and others stating it can result in root-level command execution and full device takeover. The vulnerability has been described as an authenticated remote code execution path and has been observed in intrusion activity involving persistence on compromised SMA appliances.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module targeting CVE-2021-20039, an authenticated command injection vulnerability in the SonicWall SMA 100 series web interface. The exploit requires valid credentials and targets specific vulnerable firmware versions. The module authenticates to the device, checks the firmware version, and exploits a command injection flaw in the certificate deletion functionality by sending a specially crafted payload in the CERT field of a multipart POST request to /cgi-bin/viewcert. The payload is base64-encoded and executed via perl on the target, allowing arbitrary command execution as root. The module leverages Metasploit's CmdStager to deliver and execute payloads, providing the attacker with full control over the device. The code is written in Ruby and is structured as a standard Metasploit exploit module, with clear separation of version checking, authentication, and exploitation logic. The main network endpoints involved are /cgi-bin/welcome (version check), /cgi-bin/userLogin (authentication), and /cgi-bin/viewcert (command injection).
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An authenticated remote code execution vulnerability in SonicWall SMA referenced as a possible exploitation vector in UNC6148 activity.
A known vulnerability in SonicWall SMA 100 series appliances that may allow remote attackers to gain unauthorized access.
An authenticated command injection vulnerability in SonicWall Secure Mobile Access (SMA) devices that was used by an attacker as the initial entry point, leading to web shell deployment, internal network access, and ultimately Abyss ransomware deployment.
An authenticated command injection vulnerability in SonicWall SMA 100 series appliances allowing command execution as root, enabling full device takeover.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.