CVE-2021-20049

Name of the Vulnerable Software and Affected Versions: SonicWall SMA100 versions 10.2.1.2-24sv SonicWall SMA100 versions 10.2.0.8-37sv SonicWall SMA100 versions prior to 10.2.1.2-24sv and 10.2.0.8-37sv

Description: A vulnerability in the SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses.

Recommendations: For versions 10.2.1.2-24sv, consider disabling the password change API until a patch is available. For versions 10.2.0.8-37sv, restrict access to the password change API to minimize the risk of exploitation. For versions prior to 10.2.1.2-24sv and 10.2.0.8-37sv, avoid using the password change API until the issue is resolved.