CVE-2021-20028

SonicWall SRA/SMA100

Published 4 Aug 2021 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 28 Mar 2022, with a remediation deadline of 18 Apr 2022 for US federal agencies. It has been used in ransomware campaigns.

Required action: The impacted product is end-of-life and should be disconnected if still in use.

Description

Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier

References

psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0017 · Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20028 · US Government Resource