Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2021-20039

Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

CVSS 8.8 · HighBuzz score 28.8

Buzz score

Why this CVE is surfacing

Buzz score total 28.8

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 20.8 · diversity 8.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
20.8
7 evidence mentions in the snapshot
Diversity score
8.0
3 sources across 1 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
7 source links · newest first
  • SonicWall Updates SMA 100 Appliances to Remove Overstep MalwareSecurityWeek

    The software update includes additional file checks and helps users remove the known rootkit deployed in a recent campaign.

    newswww.securityweek.comSep 24, 2025, 8:28 AM
  • SonicWall Patches Critical SMA 100 Vulnerability, Warns of Recent Malware AttackSecurityWeek

    SonicWall advises organizations to patch SMA 100 appliances and look for IoCs associated with Overstep malware attacks.

    newswww.securityweek.comJul 24, 2025, 10:18 AM
  • SonicWall SMA devices persistently infected with stealthy OVERSTEP backdoor and rootkitHelp Net Security

    Unknown intruders are targeting fully patched end-of-life SonicWall Secure Mobile Access (SMA) 100 series appliances and deploying a novel, persistent backdoor / rootkit, analysts with Google’s Threat Intelligence Group (GTIG) have warned. The analysts say UNC6148 – as they dubbed the threat group – is likely financially motivated. “An organization targeted by UNC6148 in May 2025 was posted to the ‘World Leaks’ data leak site (DLS) in June 2025, and UNC6148 activity overlaps with publicly … More →

    newswww.helpnetsecurity.comJul 16, 2025, 4:52 PM
  • SonicWall SMA Appliances Targeted With New ‘Overstep’ MalwareSecurityWeek

    A threat actor that may be financially motivated is targeting SonicWall devices with a backdoor and user-mode rootkit.

    newswww.securityweek.comJul 16, 2025, 2:00 PM
  • Details Disclosed for Recent Vulnerabilities in SonicWall Remote Access AppliancesSecurityWeek

    Rapid7 today shared details on a series of vulnerabilities that SonicWall patched in the Secure Mobile Access (SMA) 100 series secure access gateway products last month.

    newswww.securityweek.comJan 11, 2022, 6:24 PM
  • SonicWall Customers Warned of High-Risk Flaws in Remote Access AppliancesSecurityWeek

    SonicWall is urging organizations to address as soon as possible a series of recently patched vulnerabilities affecting its Secure Mobile Access (SMA) 100 series appliances.

    newswww.securityweek.comDec 9, 2021, 10:28 AM
  • SonicWall strongly urges customers to apply patches to SMA 100 devicesSecurity Affairs

    SonicWall strongly urges customers using SMA 100 series appliances to install security patches that address multiple security flaws, some of them rated as critical. Security vendor SonicWall urges customers using SMA 100 series appliances to apply security patches that address multiple security vulnerabilities, some of which have been rated as critical. “SonicWall has verified and […]

    newssecurityaffairs.comDec 8, 2021, 8:08 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence