Authenticated Command Injection in SonicWall SMA100 Management Interface

CVE-2021-20039

Summary

An authenticated command injection vulnerability exists in the SMA100 management interface, specifically at the endpoint '/cgi-bin/viewcert' when handled via the POST HTTP method. This flaw can be exploited by a remote and authenticated attacker, enabling them to execute arbitrary commands on the system as a 'nobody' user. The issue impacts numerous models within the SMA100 series, including the SMA 200, 210, 400, 410, and 500v appliances, posing significant risks to the integrity and confidentiality of data managed by these devices.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2021-20039
Created by Rapid7

References