SonicWall SMA 100 series CVE-2021-20038 (unauthenticated stack-based buffer overflow in the Apache httpd mod_cgi, CISA KEV): which appliances are affected and what to do?

What it is: CVE-2021-20038, published in December 2021, is a stack-based buffer overflow in the Apache httpd server (mod_cgi environment variables) of SonicWall SMA 100 series remote-access appliances. A remote unauthenticated attacker can potentially run code as the 'nobody' user on the appliance. CISA added it to the KEV catalog on 2022-01-28 and marks it as used in ransomware campaigns. SMA appliances are internet-facing by design, and old firmware remains a common intrusion path. Am I affected: NVD lists the SMA 200, 210, 400, 410 and 500v appliances running firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier. Find your firmware under System > Status on the management console. Check SonicWall's own advisory (SNWLID-2021-0026) for the exact fixed firmware for your model; the SMA 100 line has had further critical advisories since, so aim for the latest firmware SonicWall currently publishes for your model, and check that your model is still within vendor support. Fix: 1. Upgrade the appliance to the fixed firmware named in SonicWall's advisory or newer. Take a configuration export first and keep it offline. 2. Restrict the management interface to trusted internal addresses or a management VPN, and enable multi-factor authentication for remote users. 3. If the appliance was running affected firmware while exposed, assume it may be compromised: collect logs and any appliance diagnostics, look for unexpected admin or local accounts, changes to bookmarks/portal settings, and unusual outbound traffic. Contact SonicWall support for guidance, because device internals are limited. Reset or reimage the appliance, rebuild its configuration from a trusted source rather than restoring a possibly tainted backup, and rotate everything it holds or can reach: local and directory credentials, one-time-password seeds, certificates and private keys, and downstream service accounts. 4. If the model is end of support, plan replacement; do not leave it in service. Verify: the System > Status page shows the fixed (or newer) firmware, and the management interface is not reachable from the internet. Sources: https://nvd.nist.gov/vuln/detail/CVE-2021-20038 https://www.cisa.gov/known-exploited-vulnerabilities-catalog