critical9.8Known exploited
CVE-2021-20016
SonicWall SSLVPN SMA100 SQL Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2021-11-17.
Apply updates per vendor instructions.
Impact
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sonicwall | Sma 100 Firmware | from 10.0.0.0 before 10.2.0.5-d-29sv |
| Sonicwall | Sma 200 Firmware | All versions |
| Sonicwall | Sma 210 Firmware | All versions |
| Sonicwall | Sma 400 Firmware | All versions |
| Sonicwall | Sma 410 Firmware | All versions |
| Sonicwall | Sma 500v | All versions |