CVE-2021-20028
critical · 9.8Actively exploitedOn the CISA Known Exploited Vulnerabilities catalog
The impacted product is end-of-life and should be disconnected if still in use.
Added 2022-03-28Remediation due 2022-04-18
Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier
9.8
CVSS
30.1%
EPSS (exploit prob.)
98th
EPSS percentile
2021-08-04
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| sonicwall | sma_210_firmware | >= 8.0.0.0, < 9.0.0.10-28sv |
| sonicwall | sma_210 | all versions |
| sonicwall | sma_410_firmware | >= 8.0.0.0, < 9.0.0.10-28sv |
| sonicwall | sma_410 | all versions |
| sonicwall | sma_500v_firmware | >= 8.0.0.0, < 9.0.0.10-28sv |
| sonicwall | sma_500v | all versions |
| sonicwall | sra_4600_firmware | >= 8.0.0.0, < 9.0.0.10-28sv |
| sonicwall | sra_4600 | all versions |
| sonicwall | sra_1600_firmware | >= 8.0.0.0, < 9.0.0.10-28sv |
| sonicwall | sra_1600 | all versions |
| sonicwall | sra_va_firmware | >= 8.0.0.0, < 9.0.0.10-28sv |
| sonicwall | sra_va | all versions |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2021-20028