CVE-2021-20021
CriticalActively exploited (CISA KEV)Known to be used in ransomware campaigns
Description
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
SeverityCritical
CVSS9.8
Exploit probability—
Product
SonicWall Email Security
PublishedApr 9, 2021
First seenApr 9, 2021
Added to KEVNov 3, 2021
Weakness typeCWE-269Improper privilege management
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: Nov 17, 2021Update
- sonicwall email_security10.0.9.6103 or later
- sonicwall email_security_appliance_9000_firmware10.0.9.6105 or later
- sonicwall email_security_appliance_3300_firmware10.0.9.6105 or later
- sonicwall email_security_appliance_4300_firmware10.0.9.6105 or later
- sonicwall email_security_appliance_8300_firmware10.0.9.6105 or later
- sonicwall email_security_appliance_5000_firmware10.0.9.6105 or later
- sonicwall email_security_appliance_7000_firmware10.0.9.6105 or later
- sonicwall email_security_appliance_5050_firmware10.0.9.6105 or later
- sonicwall email_security_appliance_7050_firmware10.0.9.6105 or later
- sonicwall email_security_virtual_appliance10.0.9.6105 or later
- sonicwall hosted_email_security10.0.9.6103 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sonicwall email_security | v < 10.0.9.6103 | 10.0.9.6103 |
| sonicwall email_security_appliance_9000_firmware | v < 10.0.9.6105 | 10.0.9.6105 |
| sonicwall email_security_appliance_3300_firmware | v < 10.0.9.6105 | 10.0.9.6105 |
| sonicwall email_security_appliance_4300_firmware | v < 10.0.9.6105 | 10.0.9.6105 |
| sonicwall email_security_appliance_8300_firmware | v < 10.0.9.6105 | 10.0.9.6105 |
| sonicwall email_security_appliance_5000_firmware | v < 10.0.9.6105 | 10.0.9.6105 |
| sonicwall email_security_appliance_7000_firmware | v < 10.0.9.6105 | 10.0.9.6105 |
| sonicwall email_security_appliance_5050_firmware | v < 10.0.9.6105 | 10.0.9.6105 |
| sonicwall email_security_appliance_7050_firmware | v < 10.0.9.6105 | 10.0.9.6105 |
| sonicwall email_security_virtual_appliance | v < 10.0.9.6105 | 10.0.9.6105 |
| sonicwall hosted_email_security | v < 10.0.9.6103 | 10.0.9.6103 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.