CVE-2021-20028
SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability
Description
CVE-2021-20028 is a SQL injection vulnerability in SonicWall Secure Remote Access (SRA) products that allows an unauthenticated remote attacker to execute arbitrary SQL queries against the backend database. The vulnerability arises from improper sanitization of user-supplied input in the web management interface, enabling attackers to extract sensitive data, modify database contents, or potentially achieve command execution on the underlying system. CISA added CVE-2021-20028 to the KEV catalog on March 28, 2022, confirming active exploitation. With an EPSS score of 6.56% (94.3rd percentile), this vulnerability represents a significant threat to organizations using unpatched SonicWall SRA appliances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sonicwall | sma 210 firmware | >= 8.0.0.0, < 9.0.0.10-28sv |
| sonicwall | sma 410 firmware | >= 8.0.0.0, < 9.0.0.10-28sv |
| sonicwall | sma 500v firmware | >= 8.0.0.0, < 9.0.0.10-28sv |
| sonicwall | sra 4600 firmware | >= 8.0.0.0, < 9.0.0.10-28sv |
| sonicwall | sra 1600 firmware | >= 8.0.0.0, < 9.0.0.10-28sv |
| sonicwall | sra va firmware | >= 8.0.0.0, < 9.0.0.10-28sv |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0017(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20028(US Government Resource)
Weakness Type
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 describes a weakness where software constructs SQL commands using externally-influenced input without properly neutralizing special elements, allowing attackers to modify the intended SQL logic. In CVE-2021-20028, the SonicWall SRA web interface fails to sanitize user input before incorporating it into SQL queries, enabling an unauthenticated attacker to inject malicious SQL statements.
Learn more: CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Impact Analysis
CVE-2021-20028 enables unauthenticated SQL injection against SonicWall SRA appliances, which serve as critical remote access infrastructure for many organizations. Successful exploitation allows an attacker to query, extract, and modify the contents of the backend database, which typically contains VPN user credentials, session tokens, and access control configurations. The confidentiality impact is severe, as attackers can harvest stored credentials to gain authorized VPN access to the internal network. Depending on the database configuration and underlying operating system, SQL injection may also be leveraged for operating system command execution, potentially leading to full appliance compromise.
Exploit Maturity
CVE-2021-20028 is actively exploited in the wild, as confirmed by CISA's inclusion in the KEV catalog on March 28, 2022. The EPSS score of 6.56% (94.3rd percentile) indicates high exploitation activity relative to most CVEs, reflecting the attractiveness of SonicWall SRA appliances as a target for threat actors seeking initial network access. SonicWall VPN appliances have historically been high-value targets for ransomware groups and nation-state actors due to their position at the network perimeter.
Remediation
- Apply the SonicWall security patch addressing CVE-2021-20028 as specified in the vendor security advisory, upgrading SRA firmware to the latest available version.
- If running end-of-life SonicWall SRA products (SRA 4600/1600), migrate to supported SMA series appliances, as SonicWall discontinued support for legacy SRA products.
- Restrict management interface access to trusted IP ranges and avoid exposing the SRA web management interface directly to the internet.
- Audit VPN user accounts and access logs for signs of unauthorized access or credential theft that may have occurred prior to patching.
- Rotate all VPN user credentials and any shared secrets stored on the SRA appliance after applying the patch to mitigate potential credential compromise.
Technical Details
CVE-2021-20028 is a SQL injection vulnerability in the web management interface of SonicWall Secure Remote Access (SRA) products. The vulnerability occurs because user-supplied input is incorporated into SQL queries without proper sanitization or parameterization, allowing an unauthenticated remote attacker to inject arbitrary SQL statements. The attack is conducted over HTTP/HTTPS against the SRA web interface, requiring no authentication and minimal technical complexity. The backend database of SonicWall SRA appliances typically stores VPN credentials, session data, and device configuration, making SQL injection particularly impactful for credential theft and network infiltration.
Frequently Asked Questions
Is CVE-2021-20028 being actively exploited?
Yes, CVE-2021-20028 is confirmed as actively exploited in the wild by CISA, which added it to the KEV catalog on March 28, 2022. The EPSS score of 6.56% (94.3rd percentile) confirms significant real-world exploitation activity, particularly by threat actors targeting remote access infrastructure.
What products are affected by CVE-2021-20028?
CVE-2021-20028 affects SonicWall Secure Remote Access (SRA) products, including SRA 4600 and SRA 1600 appliances running vulnerable firmware versions. Organizations using end-of-life SRA products are at particular risk as these may no longer receive security updates.
How do I fix CVE-2021-20028?
Apply the latest SonicWall firmware update that addresses CVE-2021-20028. If running end-of-life SRA 4600/1600 products, migrate to currently supported SMA series appliances. After patching, rotate all VPN credentials stored on the appliance.
How severe is CVE-2021-20028?
CVE-2021-20028 is a high-severity SQL injection vulnerability that can be exploited without authentication. It allows credential theft and potential command execution on SonicWall SRA appliances, which are critical remote access infrastructure. The combination of unauthenticated access, active exploitation, and the sensitive nature of the target system makes this a critical-priority vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.