CyberSec.Space Logo
Back to CVE Browser

CVE-2021-20016

🔥 Known Exploited (CISA KEV)CRITICAL
9.8
CVSS Severity Score
EPSS Score81.4100%
EPSS Percentile93.33th
Published2021-02-04
Last Modified2025-10-31
Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.

Affected Platforms (CPE)

💻
Sonicwall

Sma 100 Firmware

>= 10.0.0.0 and < 10.2.0.5-d-29sv
💻
Sonicwall

Sma 200 Firmware

All versions
💻
Sonicwall

Sma 210 Firmware

All versions
💻
Sonicwall

Sma 400 Firmware

All versions

References & Advisories

🔗 https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001
🔗 https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001
🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20016

Related Security Intelligence Articles

Daily Global Cyber Threat Intelligence Digest — July 23, 2026

Key threat updates including CISA's KEV addition of Langflow CVE-2026-0770 remote code execution, unauthenticated path traversal in Windmill CVE-2026-29059, and ongoing incident response guidance for SonicWall SMA1000 zero-day exposures.

2026-07-23

Daily Global Cyber Threat Intelligence Digest — July 20, 2026

Technical analysis of zero-day exploit chains against SonicWall SMA1000 appliances (UTA0533), NGINX regular expression heap corruption vulnerabilities (CVE-2026-42533), and Sandworm's (UAC-0145) ClickFix fake CAPTCHA campaigns.

2026-07-20

Related Vulnerabilities

CVE-2026-167718.8

In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-b...

CVE-2026-656246.9

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker t...

CVE-2021-320889.8

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting f...

CVE-2021-320878.8

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The ...