# CVE-2021-20035

Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.

- Page: https://www.vulneraibility.com/cve/CVE-2021-20035
- CVSS: 6.5
- Known exploited: yes, in CISA KEV since 2025-04-16; CISA due date 2025-05-07
- EPSS: 4.41%
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-04-17)
- Weakness: CWE-78
- Published: 2021-09-27

## Affected versions

- SonicWall SMA100: affected 9.0.0.10-28sv and earlier; 10.2.0.7-34sv and earlier; 10.2.1.0-17sv and earlier

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20035

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.