CVE-2021-20038

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.

• CWE-121
• CWE-787

• https://github.com/jbaines-r7/badbloodExploit, Third Party Advisory
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026Vendor Advisory
• https://www.rapid7.com/blog/post/2022/01/11/cve-2021-20038-42-sonicwall-sma-100-multiple-vulnerabilities-fixed-2/Exploit, Third Party Advisory
• https://github.com/jbaines-r7/badbloodExploit, Third Party Advisory
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026Vendor Advisory
• https://www.rapid7.com/blog/post/2022/01/11/cve-2021-20038-42-sonicwall-sma-100-multiple-vulnerabilities-fixed-2/Exploit, Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20038US Government Resource

Published

Dec 8, 2021

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-20030SonicWall GMS is vulnerable to file path manipulation result…7.5
• CVE-2021-20031A Host Header Redirection vulnerability in SonicOS potential…6.1
• CVE-2021-20032SonicWall Analytics 2.5 On-Prem is vulnerable to Java Debug …9.8
• CVE-2021-20034An improper access control vulnerability in SMA100 allows a …9.1
• CVE-2021-20035Improper neutralization of special elements in the SMA100 ma…6.5
• CVE-2021-20037SonicWall Global VPN Client 4.10.5 installer (32-bit and 64-…7.8
• CVE-2021-20039Improper neutralization of special elements in the SMA100 ma…8.8
• CVE-2021-2004Vulnerability in the Siebel Core - Server BizLogic Script pr…4.3
• CVE-2021-20040A relative path traversal vulnerability in the SMA100 upload…7.5
• CVE-2021-20041An unauthenticated and remote adversary can consume all of t…7.5
• CVE-2021-20042An unauthenticated remote attacker can use SMA 100 as an uni…9.8
• CVE-2021-20043A Heap-based buffer overflow vulnerability in SonicWall SMA1…8.8