SonicWall published a security advisory for a critical vulnerability affecting Secure Mobile Access (SMA) appliances. The flaw, identified as CVE-2021-20034, can be exploited by a remote, unauthenticated attacker to delete arbitrary files from the targeted appliance, which could result in the device being reset to factory settings. The security hole can also allow an attacker to gain administrator access to the underlying host.

The vulnerability has been found to impact SMA 200, 210, 400, 410 and 500v appliances running versions 10.2.1.0-17sv, 10.2.0.7-34sv and 9.0.0.10-28sv, and earlier. Patches have been released for each of the affected versions.

The latest updates for SMA 100 series appliances also patch two medium-severity vulnerabilities, including one that can lead to privilege escalation to root, and one that can be exploited for authenticated arbitrary code injection and DoS attacks.

Source: securityweek.com