{"id":"CVE-2021-20028","published":"2021-08-04T19:15:08Z","modified":"2026-06-17T03:33:10Z","title":"SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability","vendor":"SonicWall","product":"Secure Remote Access (SRA)","tier":"core","eol":null,"description":{"text":"Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier","provenance":"source","from":"NVD"},"summary":{"text":"The SonicWall Secure Remote Access (SRA) appliances, running all 8.x firmware and 9.0.0.9-26sv or earlier, contain an SQL injection flaw caused by improper neutralization of special elements in SQL commands. An unauthenticated remote attacker over the network can exploit this without user interaction or any special configuration to compromise the confidentiality, integrity, and availability of the affected appliance.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:54:05Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.30084,"percentile":0.98211,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-03-28","dueDate":"2022-04-18","ransomware":true,"requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-20028","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-06-08","exploitedFirstSeen":"2021-06-08","ransomware":true,"evidence":[{"url":"https://www.crowdstrike.com/blog/how-ecrime-groups-leverage-sonicwall-vulnerability-cve-2019-7481/","date":"2021-06-08"},{"url":"https://blog.compass-security.com/2022/03/vpn-appliance-forensics/","date":"2022-03-21"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-28"},{"url":"https://static.tenable.com/marketing/whitepapers/Whitepaper-Ransomware_Ecosystem.pdf","date":"2022-06-22"},{"url":"https://www.group-ib.com/resources/research-hub/hi-tech-crime-trends-2022/","date":"2023-01-17"},{"url":"https://www.theregister.com/2023/03/09/suspected_chinese_cyberspies_target_uppatched/","date":"2023-03-09"},{"url":"https://www.greynoise.io/blog/battling-ransomware-one-tag-at-a-time","date":"2024-02-08"},{"url":"https://www.cisa.gov/sites/default/files/2024-07/aa24-207a-dprk-cyber-group-conducts-global-espionage-campaign.pdf","date":"2024-07-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-09-16&host_type=src&vulnerability=cve-2021-20028","date":"2024-09-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-09-18&host_type=src&vulnerability=cve-2021-20028","date":"2024-09-18"}],"evidenceTotal":489,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0017","tags":["Vendor Advisory"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0017","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20028","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: SQL injection via public-facing SRA appliance","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Improper neutralization of a SQL Command leading to SQL Injection vulnerability","start":0,"end":79}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: SQL injection yields command-like database execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"SQL Injection vulnerability impacting end-of-life Secure Remote Access","start":52,"end":122}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-3bd87bcc3ec7ea8da0e5","title":"LockBit 2.0: How This RaaS Operates and How to Protect Against It","publisher":"unit42.paloaltonetworks.com","url":"https://unit42.paloaltonetworks.com/lockbit-2-ransomware/","date":null,"mentions":[{"quote":"Vulnerabilities such as ProxyShell (CVE-2021-34473) and improper SQL sanitization (CVE-2021-20028) have been observed being utilized as footholds into the environment.","start":8399,"end":8566}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-7491","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-7491","exploited":true,"exploitedSince":"2022-03-28","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2021-06-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.crowdstrike.com/blog/how-ecrime-groups-leverage-sonicwall-vulnerability-cve-2019-7481/","provenance":"source"},{"date":"2021-08-04","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20028","provenance":"source"},{"date":"2022-03-28","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-28","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-7491","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":236},"priority":{"score":78.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1971 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.64,"detail":"percentile 0.9821"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}