CVE DatabaseCVE-2021-20028

Updated 2026-06-17한국어 권고문 →

CVE-2021-200289.8/CRITICALCISA KEVCWE-89CWE-89

SonicWall SRA (Secure Remote Access) SQL Injection Vulnerability (CVE-2021-20028) Analysis and Mitigation Guide

⚡ Jump to Patch

Affected Vendors

sonicwall

Affected Components

secure remote access, sra

Published Date

2021-08-04

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

30.1%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

End-of-life (EOL) SonicWall Secure Remote Access (SRA) appliances running all 8.x firmware and 9.0.0.9-26sv or earlier

Impact

Unauthenticated remote attackers can execute arbitrary SQL commands via crafted payloads, potentially leading to credential theft, database compromise, and remote code execution (RCE)

Mitigation

Since the affected products are EOL, immediately decommission the SRA appliances and migrate to supported SMA (Secure Mobile Access) series, or restrict external access via firewall rules

Affected Products & Version Scope

SonicWall SRA appliances running firmware 8.x or 9.0.0.9-26sv and earlier

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

No official patches are available for these SRA products as they have reached End-of-Life (EOL) status. SonicWall strongly advises upgrading to active, supported SMA 100 or 1000 series appliances.

2. Temporary Workaround & Hardening Configuration

If immediate replacement is not possible, restrict access to the SRA web interface (typically TCP port 443) using an upstream firewall or Access Control List (ACL) to allow only trusted source IPs.

bash

# Example: Restricting access to the SRA appliance (192.168.1.100) to a trusted admin IP (203.0.113.50) using iptables
iptables -A FORWARD -p tcp -s 203.0.113.50 -d 192.168.1.100 --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.100 --dport 443 -j DROP

3. Log Audit & IoC Verification Commands

Audit the SRA web server access logs for common SQL injection patterns and anomalous database query strings.

bash

# Search web access logs for potential SQL injection payloads and keywords
grep -Ei 'union|select|insert|update|delete|drop|delay|waitfor|benchmark' /var/log/httpd/access_log

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Decommission the EOL SRA appliances immediately and transition to supported SMA hardware to prevent active exploitation.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-20028) is a critical SQL injection flaw (CWE-89) found in legacy, end-of-life SonicWall Secure Remote Access (SRA) physical and virtual appliances. The root cause lies in the improper neutralization of user-supplied inputs before constructing SQL queries within the web management interface. This allows unauthenticated remote attackers to inject malicious SQL commands directly into the backend database.

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this vulnerability by sending specially crafted HTTP requests containing SQL syntax (such as single quotes, UNION operators, or stacked queries) to vulnerable endpoints on the SRA web portal. Because the input is concatenated directly into SQL statements, the database interpreter executes the injected commands. This can be leveraged to bypass authentication, extract sensitive session tokens, modify administrative credentials, or execute system-level commands via database extensions.

3. Infrastructure & Business Impact

As SRA appliances serve as the gateway to internal corporate networks, compromise of these devices can lead to full internal network penetration and severe business disruption. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog with a high EPSS score (0.3008), making immediate remediation a top priority.

Official Vendor Advisories & References

NVD Original English Description

Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0017

Source: PSIRT@sonicwall.com · Vendor Advisory

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0017

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20028

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2021-20028)

FAQ

Q1. How critical is CVE-2021-20028 and is it actively exploited in the wild?

CVE-2021-20028 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 30.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2021-20028?

Primary impacted vendors include sonicwall across secure remote access, sra. Scope summary: SonicWall SRA appliances running firmware 8.x or 9.0.0.9-26sv and earlier

Q3. What temporary mitigations or workarounds exist for CVE-2021-20028 before patching?

[Mitigation] Since the affected products are EOL, immediately decommission the SRA appliances and migrate to supported SMA (Secure Mobile Access) series, or restrict external access via firewall rules Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION