CVE-2021-20050 Missing authorization in SonicWall SMA100

What is CVE-2021-20050?

CVE-2021-20050 is a high-severity missing authorization vulnerability in SonicWall SMA100, published on 23 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data.

Weakness: CWE-284

Which versions are affected by CVE-2021-20050?

It affects 6 products.

Products include Sonicwall Sma 100 Firmware, Sonicwall Sma 200 Firmware, Sonicwall Sma 210 Firmware, Sonicwall Sma 400 Firmware, Sonicwall Sma 410 Firmware, Sonicwall Sma 500v Firmware.

How do I fix CVE-2021-20050?

No fix has been published for CVE-2021-20050 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-20050 being exploited?

There is no known exploitation of CVE-2021-20050 in the wild and no public exploit code.

Other vulnerabilities in SonicWall SMA100

• CVE-2021-20016 SonicWall SSLVPN SMA100 SQL Injection Exploited Critical 9.8
• CVE-2019-7483 SonicWall SMA100 Directory Traversal Exploited High 7.5
• CVE-2019-7481 SonicWall SMA100 SQL Injection Exploited High 7.5
• CVE-2019-7482 Memory corruption in SMA100 Critical 9.8
• CVE-2025-32819 Path traversal in SMA100 High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v4vg-cx5m-vc5g.