CVE-2021-20021
SonicWall Email Security Improper Privilege Management Vulnerability
Description
CVE-2021-20021 is a critical improper privilege management vulnerability in SonicWall Email Security version 10.0.9.x. The flaw allows an unauthenticated remote attacker to create an administrative account by sending a specially crafted HTTP request to the target host, effectively granting full control over the email security appliance. CISA has added CVE-2021-20021 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and this vulnerability is known to be used in ransomware campaigns. With an EPSS score of 91.74% (99.68th percentile), exploitation is near-certain. This vulnerability is commonly chained with CVE-2021-20022 and CVE-2021-20023 to achieve full privilege escalation and data exfiltration on SonicWall Email Security appliances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sonicwall | email security | < 10.0.9.6103 |
| sonicwall | email security appliance 9000 firmware | < 10.0.9.6105 |
| sonicwall | email security appliance 3300 firmware | < 10.0.9.6105 |
| sonicwall | email security appliance 4300 firmware | < 10.0.9.6105 |
| sonicwall | email security appliance 8300 firmware | < 10.0.9.6105 |
| sonicwall | email security appliance 5000 firmware | < 10.0.9.6105 |
| sonicwall | email security appliance 7000 firmware | < 10.0.9.6105 |
| sonicwall | email security appliance 5050 firmware | < 10.0.9.6105 |
| sonicwall | email security appliance 7050 firmware | < 10.0.9.6105 |
| sonicwall | email security virtual appliance | < 10.0.9.6105 |
| sonicwall | hosted email security | < 10.0.9.6103 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0007(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20021(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
Improper Privilege Management occurs when a product does not properly assign, modify, track, or check privileges for actors. In the case of SonicWall Email Security, this weakness allows an unauthenticated attacker to bypass privilege checks entirely and create an administrator-level account through a crafted HTTP request, granting unauthorized full access to the appliance.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2021-20021 carries a CVSS 3.1 score of 9.8 (CRITICAL), representing one of the most severe vulnerability ratings possible. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, making it trivially exploitable by any network-accessible attacker. Successful exploitation results in high impact across confidentiality, integrity, and availability, as the attacker gains full administrative control over the SonicWall Email Security appliance. The EPSS score of 91.74% places this vulnerability in the 99.68th percentile, indicating near-certain active exploitation. Critically, this vulnerability has confirmed usage in ransomware campaigns, and it is commonly chained with CVE-2021-20022 (arbitrary file upload) and CVE-2021-20023 (path traversal) to achieve complete system compromise, data exfiltration, and persistent access.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-20021 in the wild by including it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2021-11-17. This vulnerability is known to be used in ransomware campaigns, significantly elevating the urgency of remediation. The EPSS score of 91.74% indicates near-certain exploitation activity. When combined with CVE-2021-20022 (unrestricted file upload) and CVE-2021-20023 (path traversal), attackers can chain these three vulnerabilities to first create an administrative account, then upload a malicious file such as a web shell, and finally read sensitive files from the system — forming a complete attack chain for persistent compromise.
Remediation
- Apply updates immediately as required by CISA KEV: update SonicWall Email Security to version 10.0.9.6103 or later for virtual deployments, and to version 10.0.9.6105 or later for hardware appliances (models 3300, 4300, 5000, 5050, 7000, 7050, 8300, 9000).
- Verify that all SonicWall Email Security instances across your environment have been identified and patched. Also address the related vulnerabilities CVE-2021-20022 and CVE-2021-20023, which are commonly exploited in chain with this vulnerability.
- If immediate patching is not possible, restrict network access to the SonicWall Email Security management interface to trusted administrative networks only. Implement IP-based access control lists and disable any unnecessary external-facing management ports.
- Monitor SonicWall Email Security logs for indicators of compromise, including unexpected administrator account creation, unusual HTTP request patterns to management endpoints, and signs of web shell deployment or unauthorized file access.
- Implement robust role-based access control and enforce server-side privilege validation for all administrative operations. Conduct a thorough post-incident review to determine if the vulnerability was exploited before patching.
Technical Details
CVE-2021-20021 exploits an improper privilege management flaw in SonicWall Email Security version 10.0.9.x where the application fails to properly validate privilege requirements before processing administrative account creation requests. An unauthenticated attacker can send a crafted HTTP request to the management interface that bypasses authentication checks, resulting in the creation of a new administrator account. The CVSS vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that this is a network-exploitable vulnerability with no prerequisites — no authentication, no user interaction, and low complexity — leading to complete compromise of confidentiality, integrity, and availability. The vulnerability affects multiple SonicWall products including Email Security software, Hosted Email Security, and all hardware appliance models (3300, 4300, 5000, 5050, 7000, 7050, 8300, 9000) running firmware prior to version 10.0.9.6105.
Frequently Asked Questions
Is CVE-2021-20021 being actively exploited?
Yes. CVE-2021-20021 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. It is also known to be used in ransomware campaigns. The EPSS score of 91.74% (99.68th percentile) indicates near-certain exploitation probability.
What products are affected by CVE-2021-20021?
CVE-2021-20021 affects SonicWall Email Security version 10.0.9.x, including the software version (prior to 10.0.9.6103), Hosted Email Security (prior to 10.0.9.6103), Email Security Virtual Appliance (prior to 10.0.9.6105), and all hardware appliance models 3300, 4300, 5000, 5050, 7000, 7050, 8300, and 9000 (prior to firmware 10.0.9.6105).
How do I fix CVE-2021-20021?
Update SonicWall Email Security to version 10.0.9.6103 or later for software and hosted deployments, and to version 10.0.9.6105 or later for hardware appliances. Also patch the related chained vulnerabilities CVE-2021-20022 and CVE-2021-20023.
How severe is CVE-2021-20021?
CVE-2021-20021 has a CVSS 3.1 score of 9.8 (CRITICAL) and an EPSS score in the 99.68th percentile. It allows unauthenticated administrative account creation and is known to be exploited in ransomware attacks, making it one of the most urgent vulnerabilities to remediate.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.