| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CVE-2021-20035 | SonicWall SMA100 Appliances OS Command Injection Vulnerability | exploitation_technique | T1078 | Valid Accounts |
Comments
While this vulnerability was originally considered a denial-of-service issue in 2021, this improper neutralization issue has been exploited in 2025 as a remote code execution vulnerability. After authenticating (either with default credentials or via brute force, password stuffing, or dictionary attacks), an attacker can execute arbitrary commands as a "nobody" user.
References
|
| CVE-2021-20035 | SonicWall SMA100 Appliances OS Command Injection Vulnerability | exploitation_technique | T1059 | Command and Scripting Interpreter |
Comments
While this vulnerability was originally considered a denial-of-service issue in 2021, this improper neutralization issue has been exploited in 2025 as a remote code execution vulnerability. After authenticating (either with default credentials or via brute force, password stuffing, or dictionary attacks), an attacker can execute arbitrary commands as a "nobody" user.
References
|