Actively exploited · Published Feb 3, 2021 · Assigned by sonicwall

CVE-2021-20016

Critical 9.8 Exploited Ransomware

In plain English

A critical-severity SQL injection in SonicWall SMA100 from SonicWall. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 40.0% (higher than 99% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)40.0%top 1.4% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Nov 17, 2021.

Official description

A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.

Affected products (as reported)

Vendor	Product	Versions
SonicWall	SonicWall SMA100	SMA100 build version 10.x

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001 x_refsource_CONFIRM
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20016 government-resource