CVSS v3
6.5
MEDIUM
EPSS Score
4.0%
exploit probability
CISA KEV
Yes
known exploited
Exploitation
—
SSVC status
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.
Yes. CVE-2021-20035 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 5/7/2025.
CVE-2021-20035 has a CVSS v3 base score of 6.5 (MEDIUM severity).
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
Ranked by exploit probability (EPSS).