CVE-2021-20016: SonicWall SMA100 SSLVPN SQL injection allows unauthenticated access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote SQL injection on an internet-facing VPN gateway with a 9.8 CVSS score, KEV listing and ransomware use makes this an urgent patch-first issue.

What it is

SonicWall SSLVPN SMA100 firmware 10.x contains a SQL injection flaw in its SSLVPN interface. A remote attacker with no credentials can inject SQL to read usernames, passwords and session data from the appliance database. Because the device is an internet-facing remote-access gateway, compromise exposes both the appliance and the sessions it brokers.

Impact

An unauthenticated attacker gains read access to stored credentials and session information, which can be reused to log in as legitimate users or administrators and pivot into the protected network.

Attack surface

Reachable over the network through the SSLVPN web interface; the CVSS vector shows no privileges and no user interaction required, so any host that can reach the appliance can attempt the injection.

Exploitation

Listed in CISA KEV with a 2021-11-17 remediation due date and flagged for known ransomware campaign use; EPSS 30-day probability is about 0.40 (98.6th percentile), indicating active exploitation is likely.

What to do

• Apply the vendor update for SMA100 10.x per SonicWall PSIRT advisory SNWLID-2021-0001; patch is the only complete fix.
• If patching cannot be done immediately, apply the mitigations in the SonicWall advisory and restrict SSLVPN exposure to trusted networks.
• Rotate credentials and invalidate sessions for all accounts that authenticate through the SMA appliance, since stored usernames, passwords and session data may have been read.
• Enable and forward SMA logs to a central SIEM so injection attempts and anomalous logins are retained.
• Review the appliance for unauthorized accounts, configuration changes or persistence after any suspected exposure.

Detection

• Search SMA/SSLVPN web logs for SQL metacharacters (quotes, UNION, OR 1=1, comment sequences) in request parameters and URIs.
• Alert on authentication events from unexpected source IPs or at unusual times for accounts that use the SMA gateway.
• Monitor for repeated failed or malformed requests to SSLVPN endpoints from a single source, which may indicate automated injection attempts.
• Correlate SMA log entries with downstream authentication and lateral-movement activity to catch credential reuse after a successful injection.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.