FKIE_CVE-2021-20024

Vulnerability from fkie_nvd - Published: 2021-07-09 22:15 - Updated: 2026-06-17 03:33
Severity
8.1 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Summary
Multiple Out-of-Bound read vulnerability in SonicWall Switch when handling LLDP Protocol allows an attacker to cause a system instability or potentially read sensitive information from the memory locations.
References
PSIRT@sonicwall.comhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0011Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0011Vendor Advisory
Impacted products
Vendor Product Version
sonicwall switch *
sonicwall sws12-10fpoe -
sonicwall sws12-8 -
sonicwall sws12-8poe -
sonicwall sws14-24 -
sonicwall sws14-24fpoe -
sonicwall sws14-48 -
sonicwall sws14-48fpoe -
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "SonicWall Switch",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.5-16 and earlier"
            }
          ]
        }
      ],
      "source": "PSIRT@sonicwall.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:switch:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "076786F3-94BB-447A-B66C-07B89A2F1E58",
              "versionEndIncluding": "1.0.0.5-16",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:sws12-10fpoe:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC1B14D9-15C7-4490-9A2C-4FD9462CF465",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:sonicwall:sws12-8:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F93E9E20-D465-490B-B2E0-A92670684ECE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:sonicwall:sws12-8poe:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A756CC39-180C-4293-8A45-7C55DC88639B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:sonicwall:sws14-24:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "72DF3E57-4840-4327-9796-D92F663FFF4E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:sonicwall:sws14-24fpoe:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "68C4A661-5DAE-41B2-8D51-8E8F0AB4E26E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:sonicwall:sws14-48:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "04079B4A-8CF2-4D17-B9AB-CF9A84692CAD",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:sonicwall:sws14-48fpoe:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "49B54692-77FD-411F-90F4-AAE31E48D5B8",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple Out-of-Bound read vulnerability in SonicWall Switch when handling LLDP Protocol allows an attacker to cause a system instability or potentially read sensitive information from the memory locations."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de lectura  fuera de l\u00edmites en SonicWall Switch cuando se maneja el protocolo LLDP permite a un atacante causar una inestabilidad del sistema o leer potencialmente informaci\u00f3n confidencial de las ubicaciones de memoria"
    }
  ],
  "id": "CVE-2021-20024",
  "lastModified": "2026-06-17T03:33:09.943",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "ADJACENT_NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 6.5,
        "impactScore": 7.8,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-07-09T22:15:08.320",
  "references": [
    {
      "source": "PSIRT@sonicwall.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0011"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0011"
    }
  ],
  "sourceIdentifier": "PSIRT@sonicwall.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "PSIRT@sonicwall.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.