# CVE-2021-20038: SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability

Source: https://junglewise.ai/threats/cve-2021-20038-sonicwall-sma-100-appliances-stack-based-buffer-overflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-01-28. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2021-20038 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2022-01-28

A stack-based buffer overflow vulnerability exists in the SonicWall SMA 100 series Apache httpd server's mod_cgi module. Remote unauthenticated attackers can exploit this via environment variables to execute arbitrary code as the 'nobody' user.

Vendors: [SonicWall](https://junglewise.ai/threats/vendors/sonicwall).

## Quick answers

**Is CVE-2021-20038 exploited in the wild?** Yes. CVE-2021-20038 is known to be exploited in the wild, first recorded on 28 January 2022. Treat it as urgent.

**How severe is CVE-2021-20038?** Critical severity, with a CVSS score of 9.8, published 28 January 2022.

**Which products and versions are affected?** SonicWall SMA 200 firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions; SonicWall SMA 210 firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions; SonicWall SMA 400 firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions; SonicWall SMA 410 firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions; and 1 more.

**Is there a fix for CVE-2021-20038?** A patch was published on 2022-01-11: Rapid7 reported fixes for multiple vulnerabilities including CVE-2021-20038. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-20038 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2021-20038?** Check whether you run SonicWall SMA 100 Appliances. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- SonicWall SMA 200 firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions
- SonicWall SMA 210 firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions
- SonicWall SMA 400 firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions
- SonicWall SMA 410 firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions
- SonicWall SMA 500v firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions

## Timeline

- 2022-01-11: patched: Rapid7 reported fixes for multiple vulnerabilities including CVE-2021-20038.
- 2022-01-28: disclosed: NVD publication date.
- 2022-01-28: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.
- 2022-01-28: exploited: Reported as exploited in the wild.