CVE-2021-20016 SonicWall SSLVPN SMA100 SQL Injection

Exploited in the wild Critical 9.8 Published 3 Feb 2021 Updated 12 Aug 2026

Remote unauthenticated attackers can exploit SQL injection in SonicWall SMA100 to access sensitive user credentials and session data.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-20016?

CVE-2021-20016 is a critical SQL injection vulnerability in SonicWall SMA100, published on 3 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.

Weakness: CWE-89

Which versions are affected by CVE-2021-20016?

It affects 6 products.

Products include Sonicwall Sma 100 Firmware, Sonicwall Sma 200 Firmware, Sonicwall Sma 210 Firmware, Sonicwall Sma 400 Firmware, Sonicwall Sma 410 Firmware, Sonicwall Sma 500v.

How do I fix CVE-2021-20016?

No fix has been published for CVE-2021-20016 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 17 Nov 2021.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2021-20016 being exploited?

Yes. Attackers have exploited CVE-2021-20016 in the wild since at least 3 Nov 2021, including in ransomware campaigns.

Sources

Also known as GHSA-c283-6775-92m9.