IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
9.8Crítica KEV Usada en ransomware

CVE-2021-20028SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability

SonicWall SonicWall SRA/SMA100 Publicada: (hace 5 años)

Explotación conocida — SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability

CISA confirmó el 28.03.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 18.04.2022.

Acción requerida: The impacted product is end-of-life and should be disconnected if still in use. https://nvd.nist.gov/vuln/detail/CVE-2021-20028

Descripción

Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier

Debilidad (CWE): CWE-89

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
sonicwall sma 210 firmware 8.0.0.0 – < 9.0.0.10-28sv
sonicwall sma 410 firmware 8.0.0.0 – < 9.0.0.10-28sv
sonicwall sma 500v firmware 8.0.0.0 – < 9.0.0.10-28sv
SonicWall SonicWall SRA/SMA100 8.x firmware, 9.0.0.9-26sv and earlier.
sonicwall sra 1600 firmware 8.0.0.0 – < 9.0.0.10-28sv
sonicwall sra 4600 firmware 8.0.0.0 – < 9.0.0.10-28sv
sonicwall sra va firmware 8.0.0.0 – < 9.0.0.10-28sv

Referencias y parches

Coincidencias CPE (NVD) (6)
  • cpe:2.3:o:sonicwall:sma_210_firmware:*:*:*:*:*:*:*:* ≥ 8.0.0.0 < 9.0.0.10-28sv
  • cpe:2.3:o:sonicwall:sma_410_firmware:*:*:*:*:*:*:*:* ≥ 8.0.0.0 < 9.0.0.10-28sv
  • cpe:2.3:o:sonicwall:sma_500v_firmware:*:*:*:*:*:*:*:* ≥ 8.0.0.0 < 9.0.0.10-28sv
  • cpe:2.3:o:sonicwall:sra_4600_firmware:*:*:*:*:*:*:*:* ≥ 8.0.0.0 < 9.0.0.10-28sv
  • cpe:2.3:o:sonicwall:sra_1600_firmware:*:*:*:*:*:*:*:* ≥ 8.0.0.0 < 9.0.0.10-28sv
  • cpe:2.3:o:sonicwall:sra_va_firmware:*:*:*:*:*:*:*:* ≥ 8.0.0.0 < 9.0.0.10-28sv

CVE recientes del mismo producto — SonicWall

5.1Media
CVE-2026-19703
SonicWall SonicOS

A weak password hashing vulnerability has been identified on SonicOS virtual appliances, which in specific conditions could potentially enable an attacker with existing local access to disclose a platform credential. The credential provides access to a limite…

5.9Media
CVE-2026-77709
SonicWall SonicOS

A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service.

5.9Media
CVE-2026-77708
SonicWall SonicOS

A pre-authentication stack-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service.

7.5Alta
CVE-2026-82308
SonicWall SonicOS

A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which could potentially enable a remote unauthenticated attacker to cause an application level denial of service.

8.8Alta
CVE-2026-107154
SonicWall SonicOS

A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.