CVE-2021-20016

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Aug 12, 2026

Description

A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
SonicWall	SonicWall SMA100	SMA100 build version 10.x

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001Mitigation, Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001Mitigation, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20016US Government Resource

Timeline

Published: Feb 4, 2021
Last modified: Aug 12, 2026
Added to CISA KEV: Nov 3, 2021
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-200178.8A post-authenticated command injection vulnerability in SonicWall SMA100 allows an authenticated attacker to execute OS commands as a 'nobod CVE-2021-200184.9A post-authenticated vulnerability in SonicWall SMA100 allows an attacker to export the configuration file to the specified email address. T CVE-2021-200197.5A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted HTTP request, this can potentially lead CVE-2021-20024.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.22 CVE-2021-200209.8A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root.CVE-2021-200219.8A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted CVE-2021-200227.2SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to CVE-2021-200234.9SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on th CVE-2021-200248.1Multiple Out-of-Bound read vulnerability in SonicWall Switch when handling LLDP Protocol allows an attacker to cause a system instability or CVE-2021-200257.8SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at ini CVE-2021-200268.8A vulnerability in the SonicWall NSM On-Prem product allows an authenticated attacker to perform OS command injection using a crafted HTTP r CVE-2021-200277.5A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted reques