CVE-2021-20016

Assessment

Why it matters

CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 37.0%; technical severity is CVSS 9.8.

A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.

Who should care

• Teams operating Sma 100 Firmware, Sma 200 Firmware, Sma 210 Firmware +4 more
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether Sma 100 Firmware, Sma 200 Firmware, Sma 210 Firmware +4 more is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. SonicWall Security advisory SNWLID 2021 0001
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89

Affected versions

SonicWall Sma 100 Firmware (Start Including 10.0.0.0, End Excluding 10.2.0.5-d-29sv); SonicWall Sma 200 Firmware (Version -); SonicWall Sma 210 Firmware (Version -); SonicWall Sma 400 Firmware (Version -); SonicWall Sma 410 Firmware (Version -); SonicWall Sma 500v (Version -); SonicWall SSLVPN SMA100

Fixed versions

SonicWall Sma 100 Firmware (Fixed from 10.2.0.5-d-29sv)

Published

4 February 2021

Attack vector

Network

Privileges required

None

User interaction

None

Signal timeline

1. 4 Feb 2021CVE published
2. 2 Nov 2021Added to CISA KEV
3. 21 Aug 2026Latest EPSS score: 37.0%
4. 19 Aug 2026 · 12:58 UTCSignal calculated at 80

External references

• CISA Government advisory CVE-2021-20016 ↗