SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-01-28
• Known to be used in ransomware campaigns
• EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.

CISA: SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 11 Feb 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/jbaines-r7/badbloodExploitThird Party Advisory
• psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026Vendor Advisory
• www.rapid7.com/blog/post/2022/01/11/cve-2021-20038-42-sonicwall-sma-100-multiple-vulner…ExploitThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource