CVE-2021-20019 is a high-severity vulnerability in SonicWall SonicOS and SonicOSv that allows for sensitive data disclosure. An unauthenticated attacker can craft an HTTP request to leak partial memory from the device's HTTP server, potentially exposing internal sensitive information. With a CVSS score of 7.5, this vulnerability is easily exploitable over the network with low attack complexity and no user interaction required. While there is no public exploit code available in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered significant community discussion and media coverage, including reports of an incomplete patch.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 7.0.0, < 7.0.0.376CPE matchmatch criteria | cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* | ||
>= 7.0.1, < 7.0.1-r1036CPE matchmatch criteria | cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* | ||
6.0.5.3-94oCPE matchmatch criteria | cpe:2.3:o:sonicwall:sonicos:6.0.5.3-94o:*:*:*:*:*:*:* | ||
6.5.1.12-3nCPE matchmatch criteria | cpe:2.3:o:sonicwall:sonicos:6.5.1.12-3n:*:*:*:*:*:*:* | ||
6.5.4.7-83nCPE matchmatch criteria | cpe:2.3:o:sonicwall:sonicos:6.5.4.7-83n:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.