CVE-2021-20021

CVE-2021-20021 is a critical-severity (CVSS 9.8) vulnerability in SonicWall SonicWall Email Security. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by November 17, 2021. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. SonicWall has 19 vulnerabilities in the KEV catalog, 13 of them linked to ransomware.

A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0007
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0007
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20021