Actively exploited · Published Apr 9, 2021 · Assigned by sonicwall

CVE-2021-20021

Critical 9.8 Exploited Ransomware

In plain English

A critical-severity privilege mismanagement in Email Security from SonicWall. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 88.8% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)88.8%top 0.2% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack tooling2Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Nov 17, 2021.

Official description

A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.

Affected products (as reported)

Vendor	Product	Versions
SonicWall	Email Security	10.0.9 and earlier

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0007 x_refsource_CONFIRM
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20021 government-resource