CVE-2021-20016

Timeline

Detection, updates, and resolution for this record.

1. Feb 3, 2021 · Catalog

   Detected

   A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.

2. Nov 3, 2021 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Nov 17, 2021 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Aug 11, 2026 · Catalog

   Updated

   A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.

Affected

• cpe sonicwall/sma 100 firmwareversion unspecified
• cpe sonicwall/sma 200 firmwareversion unspecified
• cpe sonicwall/sma 210 firmwareversion unspecified
• cpe sonicwall/sma 400 firmwareversion unspecified
• cpe sonicwall/sma 410 firmwareversion unspecified
• cpe sonicwall/sma 500vversion unspecified
• vendor SonicWall SSLVPN SMA100version unspecified

Sources

• CISA KEVCVE-2021-20016

  SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.

  cisa.gov
• CVE.orgCVE-2021-20016

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2021-20016

  30-day exploitation probability 40.0%

  first.org
• NIST NVDCVE-2021-20016

  A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• Mitigation · psirt.global.sonicwall.com
• US Government Resource · cisa.gov