CVE-2021-20028

Timeline

Detection, updates, and resolution for this record.

1. Aug 4, 2021 · Catalog

   Detected

   Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier

2. Mar 28, 2022 · CISA KEV

   Known exploited

   The impacted product is end-of-life and should be disconnected if still in use.

3. Apr 18, 2022 · CISA KEV

   Remediation due

   The impacted product is end-of-life and should be disconnected if still in use.

4. Jun 16, 2026 · Catalog

   Updated

   Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier

Affected

• cpe sonicwall/sma 210 firmwareversion unspecified
• cpe sonicwall/sma 410 firmwareversion unspecified
• cpe sonicwall/sma 500v firmwareversion unspecified
• cpe sonicwall/sra 1600 firmwareversion unspecified
• cpe sonicwall/sra 4600 firmwareversion unspecified
• cpe sonicwall/sra va firmwareversion unspecified
• vendor SonicWall Secure Remote Access (SRA)version unspecified

Sources

• CISA KEVCVE-2021-20028

  SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.

  cisa.gov
• CVE.orgCVE-2021-20028

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2021-20028

  30-day exploitation probability 30.1%

  first.org
• NIST NVDCVE-2021-20028

  Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• Vendor Advisory · psirt.global.sonicwall.com
• US Government Resource · cisa.gov