Actively exploited · Published Aug 4, 2021 · Assigned by sonicwall
CVE-2021-20028
Critical 9.8 Exploited Ransomware
In plain English
A critical-severity SQL injection in SonicWall SRA/SMA100 from SonicWall. Attackers are actively exploiting it in the wild (listed by CISA on March 28, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 30.1% (higher than 98% of all known vulnerabilities). The impacted product is end-of-life and should be disconnected if still in use.
CISA guidance
The impacted product is end-of-life and should be disconnected if still in use.
Federal agencies must remediate by Apr 18, 2022.
Official description
Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SonicWall | SonicWall SRA/SMA100 | 8.x firmware9.0.0.9-26sv and earlier. |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0017 x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20028 government-resource