Threat Investigation
Request a demo

CVE-2021-20028

CriticalActively exploited (CISA KEV)Known to be used in ransomware campaigns

Description

Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier

SeverityCritical
CVSS9.8
Exploit probability—
ProductSonicWall Secure Remote Access (SRA)
PublishedAug 4, 2021
First seenAug 4, 2021
Added to KEVMar 28, 2022
Weakness typeCWE-89SQL injection

How to fix

CISA required action

The impacted product is end-of-life and should be disconnected if still in use.

CISA due date: Apr 18, 2022
Update
  • sonicwall sma_210_firmware9.0.0.10-28sv or later
  • sonicwall sma_410_firmware9.0.0.10-28sv or later
  • sonicwall sma_500v_firmware9.0.0.10-28sv or later
  • sonicwall sra_4600_firmware9.0.0.10-28sv or later
  • sonicwall sra_1600_firmware9.0.0.10-28sv or later
  • sonicwall sra_va_firmware9.0.0.10-28sv or later

Affected products

ProductAffected versionsFixed in
sonicwall sma_210_firmware8.0.0.0 ≤ v < 9.0.0.10-28sv9.0.0.10-28sv
sonicwall sma_410_firmware8.0.0.0 ≤ v < 9.0.0.10-28sv9.0.0.10-28sv
sonicwall sma_500v_firmware8.0.0.0 ≤ v < 9.0.0.10-28sv9.0.0.10-28sv
sonicwall sra_4600_firmware8.0.0.0 ≤ v < 9.0.0.10-28sv9.0.0.10-28sv
sonicwall sra_1600_firmware8.0.0.0 ≤ v < 9.0.0.10-28sv9.0.0.10-28sv
sonicwall sra_va_firmware8.0.0.0 ≤ v < 9.0.0.10-28sv9.0.0.10-28sv

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.