critical9.8Known exploited
CVE-2021-20021
SonicWall Email Security Improper Privilege Management Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2021-11-17.
Apply updates per vendor instructions.
Impact
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sonicwall | Email Security | before 10.0.9.6103 |
| Sonicwall | Email Security Appliance 9000 Firmware | before 10.0.9.6105 |
| Sonicwall | Email Security Appliance 3300 Firmware | before 10.0.9.6105 |
| Sonicwall | Email Security Appliance 4300 Firmware | before 10.0.9.6105 |
| Sonicwall | Email Security Appliance 8300 Firmware | before 10.0.9.6105 |
| Sonicwall | Email Security Appliance 5000 Firmware | before 10.0.9.6105 |
| Sonicwall | Email Security Appliance 7000 Firmware | before 10.0.9.6105 |
| Sonicwall | Email Security Appliance 5050 Firmware | before 10.0.9.6105 |
| Sonicwall | Email Security Appliance 7050 Firmware | before 10.0.9.6105 |
| Sonicwall | Email Security Virtual Appliance | before 10.0.9.6105 |
| Sonicwall | Hosted Email Security | before 10.0.9.6103 |