CVE-2021-20016
SonicWall SSLVPN SMA100 SQL Injection Vulnerability
Description
CVE-2021-20016 is a critical SQL injection vulnerability affecting SonicWall SMA100 series SSLVPN appliances. The flaw exists in the SMA100 build version 10.x, allowing a remote unauthenticated attacker to perform SQL queries that extract usernames, passwords, and other session-related information. CISA has confirmed active exploitation of CVE-2021-20016 in the wild and added it to the Known Exploited Vulnerabilities catalog, with a known association to ransomware campaigns. The EPSS score of 78.0% (99.0th percentile) indicates near-certain exploitation activity, making immediate remediation essential for any organization running affected SonicWall SMA appliances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sonicwall | sma 100 firmware | >= 10.0.0.0, < 10.2.0.5-d-29sv |
| sonicwall | sma 200 firmware | - |
| sonicwall | sma 210 firmware | - |
| sonicwall | sma 400 firmware | - |
| sonicwall | sma 410 firmware | - |
| sonicwall | sma 500v | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20016(US Government Resource)
Weakness Type
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
SQL Injection occurs when user-controlled input is incorporated into SQL queries without proper sanitization or parameterization. In the case of the SonicWall SMA100 SSLVPN, the vulnerability allows attackers to inject malicious SQL statements through the web interface, bypassing authentication and extracting sensitive credential data directly from the database.
Learn more: CWE-89 — Improper Neutralization of Special Elements used in an SQL Command
Impact Analysis
CVE-2021-20016 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting its extreme severity. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and demands no user interaction, making it trivially easy for attackers to exploit. Successful exploitation grants full access to sensitive credentials including usernames and hashed passwords, enabling complete compromise of confidentiality, integrity, and availability of the affected SonicWall SMA100 device. With an EPSS score of 78.0%, exploitation is highly likely. This vulnerability is also known to have been leveraged in ransomware campaigns, posing a severe risk to organizations that rely on SonicWall VPN appliances for remote access.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-20016 in the wild through its inclusion in the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2021-11-17. This vulnerability is also known to be associated with ransomware campaigns, significantly increasing the threat level. The EPSS score of 78.0% (99.0th percentile) indicates a very high probability of exploitation activity. Federal agencies and critical infrastructure organizations should treat this as an emergency-priority remediation item.
Remediation
- Apply updates per vendor instructions as required by CISA KEV. Upgrade SonicWall SMA100 firmware to version 10.2.0.5-d-29sv or later, which addresses the SQL injection vulnerability.
- Verify all SonicWall SMA100 series devices (SMA 200, SMA 210, SMA 400, SMA 410, SMA 500v) are running patched firmware versions beyond 10.2.0.5-d-29sv.
- Immediately reset all credentials for local accounts on the SMA appliance, as existing usernames and passwords may have been exfiltrated via SQL injection prior to patching.
- Restrict management interface access to trusted IP ranges and implement multi-factor authentication for all VPN connections to reduce the attack surface.
- Review VPN access logs and database query logs for indicators of SQL injection attempts, including unusual query patterns and unauthorized session activity.
Technical Details
CVE-2021-20016 is a SQL injection vulnerability in the SonicWall SMA100 SSLVPN product affecting build version 10.x. The flaw resides in the web-facing authentication interface, where user-supplied input is directly incorporated into SQL queries without adequate sanitization or use of parameterized statements. The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms the vulnerability is network-accessible, requires low complexity to exploit, and needs neither privileges nor user interaction. An attacker can craft malicious SQL statements to query the underlying database, extracting usernames, hashed passwords, and active session tokens, effectively bypassing authentication entirely and gaining unauthorized access to the VPN appliance and any networks behind it.
Frequently Asked Questions
Is CVE-2021-20016 being actively exploited?
Yes. CVE-2021-20016 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. It has also been associated with ransomware campaigns, and the EPSS score of 78.0% (99.0th percentile) indicates a very high probability of exploitation.
What products are affected by CVE-2021-20016?
CVE-2021-20016 affects SonicWall SMA100 series SSLVPN appliances running firmware version 10.x prior to 10.2.0.5-d-29sv. Specifically affected models include SMA 100, SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v.
How do I fix CVE-2021-20016?
Upgrade the SonicWall SMA100 firmware to version 10.2.0.5-d-29sv or later. After patching, reset all local account credentials as they may have been compromised. Enable multi-factor authentication and restrict management interface access to trusted networks.
How severe is CVE-2021-20016?
CVE-2021-20016 has a CVSS 3.1 score of 9.8 (CRITICAL) and an EPSS score of 78.0% (99.0th percentile). It is remotely exploitable without authentication and has been used in ransomware attacks, making it one of the most urgent VPN vulnerabilities to remediate.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.