CVE DatabaseCVE-2021-20016

Updated 2026-08-12한국어 권고문 →

CVE-2021-200169.8/CRITICALCISA KEVCWE-89CWE-89

SonicWall SMA100 SSL-VPN SQL Injection and Credential Theft Vulnerability (CVE-2021-20016) Security Advisory

⚡ Jump to Patch

Affected Vendors

sonicwall

Affected Components

sma100, ssl-vpn

Published Date

2021-02-04

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

40.0%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

SonicWall SMA100 appliances running firmware build version 10.x

Impact

Unauthenticated remote attackers can execute arbitrary SQL queries to retrieve usernames, passwords, and active session information, leading to complete device compromise

Mitigation

Immediately upgrade the SMA100 firmware to version 10.2.0.5 or higher to apply official security patches

Affected Products & Version Scope

All SonicWall SMA100 firmware build versions 10.x (including SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

SonicWall recommends upgrading all affected SMA100 appliances to firmware version 10.2.0.5 or higher. Perform the upgrade via the CLI or the web management console.

bash

# Verify current firmware version and configuration status via CLI
show version

# Export and backup the current configuration before upgrading
export configuration current-config.exp

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, restrict access to the SSL-VPN portal and management interfaces using firewall Access Control Lists (ACLs) to allow only trusted IP addresses.

nginx

# Example Nginx reverse proxy configuration to restrict access to the VPN portal
server {
    listen 443 ssl;
    server_name vpn.yourdomain.com;

    location / {
        # Restrict access to trusted corporate IP ranges
        allow 192.168.1.0/24;
        allow 10.0.0.0/8;
        deny all;
        proxy_pass https://internal_sma_backend;
    }
}

3. Log Audit & IoC Verification Commands

Inspect web server access logs for common SQL injection patterns such as 'UNION SELECT', 'OR 1=1', or database schema queries.

bash

# Search access logs for potential SQL injection exploitation attempts
grep -Ei '(union.*select|select.*from|insert.*into|update.*set|delete.*from)' /var/log/sonicwall_access.log

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active exploitation in the wild (CISA KEV), immediately upgrade your SonicWall SMA100 appliances to version 10.2.0.5 or higher.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-20016) is a critical SQL Injection (CWE-89) vulnerability residing in the web interface of SonicWall SMA100 series SSL-VPN appliances. The root cause is the lack of proper input validation and parameterized queries when handling user-supplied input, allowing malicious SQL commands to be interpreted and executed by the underlying database engine.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted HTTP requests containing malicious SQL payloads to the exposed SMA100 web portal. By leveraging blind or union-based SQL injection techniques, the attacker can extract sensitive database records, including user credentials (usernames and password hashes) and active session tokens. This enables the attacker to bypass multi-factor authentication (MFA) or hijack active administrative sessions.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical), this vulnerability poses an extreme risk to enterprise infrastructure. It has been actively exploited in the wild and is cataloged in CISA's Known Exploited Vulnerabilities (KEV). Since SSL-VPN gateways serve as the primary entry point to internal corporate networks, successful exploitation can lead to lateral movement, ransomware deployment, and catastrophic data breaches.

Official Vendor Advisories & References

NVD Original English Description

A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001

Source: PSIRT@sonicwall.com · Mitigation, Vendor Advisory

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001

Source: af854a3a-2127-422b-91ae-364da2661108 · Mitigation, Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20016

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2021-20016)

FAQ

Q1. How critical is CVE-2021-20016 and is it actively exploited in the wild?

CVE-2021-20016 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 40.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2021-20016?

Primary impacted vendors include sonicwall across sma100, ssl-vpn. Scope summary: All SonicWall SMA100 firmware build versions 10.x (including SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v)

Q3. What temporary mitigations or workarounds exist for CVE-2021-20016 before patching?

[Mitigation] Immediately upgrade the SMA100 firmware to version 10.2.0.5 or higher to apply official security patches Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION