CVE-2021-20028 SonicWall Secure Remote Access (SRA) SQL Injection

Exploited in the wild Critical 9.8 Published 4 Aug 2021 Updated 21 Oct 2025

SQL injection in SonicWall SRA appliances allows attackers to read or modify data, affecting end-of-life products.

Exploited in the wild: Since 28 Mar 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-20028?

CVE-2021-20028 is a critical SQL injection vulnerability in SonicWall SRA/SMA100, published on 4 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier

Weakness: CWE-89

Which versions are affected by CVE-2021-20028?

It affects 6 products.

Products include Sonicwall Sma 210 Firmware, Sonicwall Sma 410 Firmware, Sonicwall Sma 500v Firmware, Sonicwall Sra 1600 Firmware, Sonicwall Sra 4600 Firmware, Sonicwall Sra Va Firmware.

How do I fix CVE-2021-20028?

No fix has been published for CVE-2021-20028 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 18 Apr 2022.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2021-20028 being exploited?

Yes. Attackers have exploited CVE-2021-20028 in the wild since at least 28 Mar 2022, including in ransomware campaigns.

Sources

Also known as GHSA-2gf8-x72h-g57r.