PT-2021-13742 · Sonicwall · Sonicwall Sma100

Published 2021-12-23 · Updated 2022-07-08 · CVE-2021-20049

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SonicWall SMA100 versions 10.2.1.2-24sv SonicWall SMA100 versions 10.2.0.8-37sv SonicWall SMA100 versions prior to 10.2.1.2-24sv and 10.2.0.8-37sv

Description: A vulnerability in the SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses.

Recommendations: For versions 10.2.1.2-24sv, consider disabling the password change API until a patch is available. For versions 10.2.0.8-37sv, restrict access to the password change API to minimize the risk of exploitation. For versions prior to 10.2.1.2-24sv and 10.2.0.8-37sv, avoid using the password change API until the issue is resolved.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-204

Related Identifiers

CVE-2021-20049

Affected Products

Sonicwall Sma100

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-20049 · Security Note
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0030 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20049 · Vendor Advisory