CVE-2021-20016 — SonicWall SSLVPN SMA100 SQL Injection Vulnerability

CVE-2021-20016

CRITICAL · CVSS 9.8 ⚠ KEV — EXPLOITED

EPSS exploitation probability: 98%

⚠ Listed in the CISA Known Exploited Vulnerabilities catalog — actively exploited.

Published 2021-11-03 · Last modified 2026-08-12T05:17:33.173

Summary

A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.

Affected products

SonicWall — SSLVPN SMA100

Does this affect you?

Add your gear to cvedb and we'll alert you only when SonicWall ships something exploited.

Check my exposure →

References

NVD entry
CVE.org record

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.