SonicWall SMA100 Password Change API Vulnerability
CVE-2021-20049

7.5HIGH

Key Information:

Vendor
Sonicwall
Status
Sonicwall Sma100
Vendor
CVE Published:
23 December 2021

Summary

A vulnerability exists in the SonicWall SMA100 password change API, enabling remote unauthenticated attackers to enumerate usernames based on server responses. This issue affects specific versions, including 10.2.1.2-24sv, 10.2.0.8-37sv, and earlier 10.x releases, potentially compromising system security through this exploitable flaw.

Affected Version(s)

SonicWall SMA100 10.2.0.8-37sv and earlier

SonicWall SMA100 10.2.1.2-24sv and earlier

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-202...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.