CVE-2021-20028

SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability

SonicWall Secure Remote Access (SRA)Network & edge

CVSS

9.8Critical

ExploitationExploited in the wildAdded to KEV 28 Mar 2022. Known ransomware useCISA KEV

Exploit odds (EPSS)30.1%Chance of exploitation activity in the next 30 days, higher than 98% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed inNone listedNo source names a fixed version. Check the vendor advisory below

Federal deadline18 Apr 2022Remediation due date for US federal agenciesCISA KEV

CISA required actionThe impacted product is end-of-life and should be disconnected if still in use. CISA KEV

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.

Text from CVE List