9.8
Critical
CVE-2021-20016 SonicWall SSLVPN SMA100 SQL Injection Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Known to be used
Weakness
CWE-89
Description
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SonicWall SMA100 | Versions not published |
Other CVEs of SonicWall SMA100
The 11 CVEs of SonicWall SMA100 →
CVE-2021-20050
An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being…
Not rated
CVE-2021-20049
A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100…
Not rated
CVE-2021-20045
A buffer overflow vulnerability in SMA100 sonicfiles RAC_COPY_TO (RacNumber 36) method allows a remote unauthenticated…
Not rated
CVE-2021-20044
A post-authentication remote command injection vulnerability in SonicWall SMA100 allows a remote authenticated…
Not rated