Attacker Value
Very High
CVE-2021-20016
CVE-2021-20016
(Last updated December 06, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.
Add Assessment
2
Technical Analysis
Please see the Rapid7 analysis on the zero-day vulnerability. It is suspected that CVE-2021-20016 was used to compromise SonicWall’s internal network.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
9.8 Critical
Impact Score:
5.9
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High
General Information
Vendors
- sonicwall
Products
- sma 100 firmware,
- sma 200 firmware -,
- sma 210 firmware -,
- sma 400 firmware -,
- sma 410 firmware -,
- sma 500v -
Exploited in the Wild
