CVE-2021-20028

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Aug 4, 2021
Last modified
Jun 17, 2026
Added to CISA KEV
Mar 28, 2022
NVD status
Analyzed

Related CVEs from 2021

CVE-2021-20035.4Vulnerability in the Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web Dashboards). SupCVE-2021-200307.5SonicWall GMS is vulnerable to file path manipulation resulting that an unauthenticated attacker can gain access to web directory containingCVE-2021-200316.1A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary wCVE-2021-200329.8SonicWall Analytics 2.5 On-Prem is vulnerable to Java Debug Wire Protocol (JDWP) interface security misconfiguration vulnerability which potCVE-2021-200349.1An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete aCVE-2021-200356.5Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary coCVE-2021-200377.8SonicWall Global VPN Client 4.10.5 installer (32-bit and 64-bit) incorrect default file permission vulnerability leads to privilege escalatiCVE-2021-200389.8A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticCVE-2021-200398.8Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authentiCVE-2021-20044.3Vulnerability in the Siebel Core - Server BizLogic Script product of Oracle Siebel CRM (component: Integration - Scripting). Supported versiCVE-2021-200407.5A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages orCVE-2021-200417.5An unauthenticated and remote adversary can consume all of the device's CPU due to crafted HTTP requests sent to SMA100 /fileshare/sonicfile
CVE-2021-20028: Critical severity, CVSS 9.8 | Vulnix