EXPOSURES › CVE-2021-20038
CVE-2021-20038
CRITICAL ⌖ ON CISA KEV · EXPLOITEDSonicWall SMA 100 appliances had a critical, actively exploited buffer overflow vulnerability allowing code execution without authentication.
An unauthenticated stack-based buffer overflow in SonicWall SMA 100 appliances allowed for remote code execution, which has been actively exploited. DIB organizations using these devices face significant risk of compromise and potential non-compliance with CMMC/NIST 800-171. Immediate patching and network segmentation are required.
Shame score — The vulnerability's ease of exploitation and active exploitation demonstrate a significant failure in SonicWall's security engineering and patch management, impacting customer trust.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.
"Two distinct exploit chains targeting the same vulnerability architecture within two months suggest a persistent structural weakness in the appliance line—and defenders have no IoCs for the latest one."
"SonicWall customers have confronted a barrage of attacks for years, including five actively exploited vulnerabilities in SMA 1000 appliances since late 2025."
"Critical SonicWall Remote Code Execution Vulnerabilities Actively Exploited in Attacks"
"SonicWall Patches Two New Actively Exploited Zero-Days in SMA 1000 VPNs"
"SonicWall reports two major security holes under active exploit"
"Multiple Vulnerabilities have been discovered in SonicWall SMA1000 Series Appliances, which when chained together could allow for remote code execution, potentially leading to full system compromise."
"SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution."