CVE:CVE-2021-20039
CNNVD:CNNVD-202112-556
Sonicwall SMA100是美国Sonicwall公司的一款安全访问网关设备。
SonicWall SMA100 管理界面存在操作系统命令注入漏洞，该漏洞源于 /cgi-bin/viewcert 的 POST http 方法中特殊元素的不当中和。该漏洞允许远程验证攻击者以nobody用户身份注入任意命令。此漏洞影响了 SMA 200、210、400、410 和 500v 设备。
solution:Upgrade sonicwall sma_200_firmware to a higher version than 9.0.0.11-31sv,10.2.0.8-37sv,10.2.1.1-19sv,and avoid the version 9.0.0.11-31sv,10.2.0.8-37sv,10.2.1.1-19sv; Upgrade sonicwall sma_210_firmware to a higher version than 9.0.0.11-31sv,10.2.0.8-37sv,10.2.1.1-19sv,and avoid the version 9.0.0.11-31sv,10.2.0.8-37sv,10.2.1.1-19sv; Upgrade sonicwall sma_410_firmware to a higher version than 9.0.0.11-31sv,10.2.0.8-37sv,10.2.1.1-19sv,and avoid the version 9.0.0.11-31sv,10.2.0.8-37sv,10.2.1.1-19sv; Upgrade sonicwall sma_400_firmware to a higher version than 9.0.0.11-31sv,10.2.0.8-37sv,10.2.1.1-19sv,and avoid the version 9.0.0.11-31sv,10.2.0.8-37sv,10.2.1.1-19sv; Upgrade sonicwall sma_500v_firmware to a higher version than 9.0.0.11-31sv,10.2.0.8-37sv,10.2.1.1-19sv,and avoid the version 9.0.0.11-31sv,10.2.0.8-37sv,10.2.1.1-19sv