CyberSec.Space Logo
Back to CVE Browser

CVE-2021-20028

🔥 Known Exploited (CISA KEV)CRITICAL
9.8
CVSS Severity Score
EPSS Score50.1100%
EPSS Percentile97.70th
Published2021-08-04
Last Modified2025-10-31
Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier

Affected Platforms (CPE)

💻
Sonicwall

Sma 210 Firmware

>= 8.0.0.0 and < 9.0.0.10-28sv
💻
Sonicwall

Sma 410 Firmware

>= 8.0.0.0 and < 9.0.0.10-28sv
💻
Sonicwall

Sma 500v Firmware

>= 8.0.0.0 and < 9.0.0.10-28sv
💻
Sonicwall

Sra 4600 Firmware

>= 8.0.0.0 and < 9.0.0.10-28sv

References & Advisories

🔗 https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0017
🔗 https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0017
🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20028

Related Security Intelligence Articles

Daily Global Cyber Threat Intelligence Digest — July 23, 2026

Key threat updates including CISA's KEV addition of Langflow CVE-2026-0770 remote code execution, unauthenticated path traversal in Windmill CVE-2026-29059, and ongoing incident response guidance for SonicWall SMA1000 zero-day exposures.

2026-07-23

Daily Global Cyber Threat Intelligence Digest — July 20, 2026

Technical analysis of zero-day exploit chains against SonicWall SMA1000 appliances (UTA0533), NGINX regular expression heap corruption vulnerabilities (CVE-2026-42533), and Sandworm's (UAC-0145) ClickFix fake CAPTCHA campaigns.

2026-07-20

Related Vulnerabilities

CVE-2026-167718.8

In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-b...

CVE-2021-320889.8

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting f...

CVE-2021-320878.8

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The ...

CVE-2021-320869.8

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to...