CVE-2021-20028

What it actually does

CVE-2021-20028 is an unauthenticated, network-reachable SQL injection flaw in end-of-life SonicWall Secure Remote Access appliances running affected 8.x firmware and 9.0.0.9-26sv or earlier. Because attacker-controlled input is not safely neutralized before being used in SQL statements, a remote attacker can manipulate backend database queries through the appliance web interface. With a CVSS score of 9.8 and no authentication or user interaction required, successful exploitation can allow disclosure, modification, or destruction of appliance data and may enable further compromise of the remote-access device depending on exposed data, application logic, and appliance configuration.

Why it matters to the business

This vulnerability affects internet-facing remote-access infrastructure, which is commonly exposed to untrusted networks and often has access to sensitive authentication, VPN, and session-related data. Exploitation can result in credential exposure, unauthorized remote access, service disruption, and compromise of the secure-access perimeter. The risk is elevated because it is listed in CISA KEV, has documented active exploitation, has been associated with ransomware activity, and the CISA remediation deadline of 2022-04-18 has long passed. Because the affected firmware is end-of-life and no fixed versions were provided for those branches, continued operation creates persistent operational and compliance risk.

How an attack unfolds

An attacker first identifies an internet-facing SonicWall SRA/SMA appliance by scanning for exposed HTTPS management or VPN portals and fingerprinting firmware or product behavior. The attacker then sends crafted HTTP requests containing SQL control characters or expressions to a vulnerable web endpoint that incorporates request parameters into backend database queries without proper neutralization. If the appliance is vulnerable, the injected SQL changes the intended query behavior, allowing the attacker to enumerate database content, extract sensitive records, alter stored values, or interfere with application state. In a real intrusion, this access may be used to obtain credentials, session material, configuration data, or user information, followed by attempts to authenticate through the VPN, move into internal networks, deploy tooling, or support ransomware operations.

How to fix it

Retire affected end-of-life SonicWall SRA firmware and migrate to a supported SonicWall SMA/SRA platform and supported firmware branch. Treat all SRA appliances running any 8.x firmware, or 9.0.0.9-26sv or earlier, as vulnerable unless SonicWall guidance explicitly states otherwise. Because no fixed versions were provided for the affected end-of-life branches, do not rely on compensating controls as a long-term fix. If immediate replacement is not possible, remove the appliance from direct internet exposure, restrict access to trusted source IP ranges through upstream firewalls or VPN concentrators, disable unnecessary portal features, apply vendor-recommended mitigations, monitor aggressively, and plan emergency replacement. After remediation, rotate local appliance credentials, VPN user credentials, API or service credentials, and any secrets that may have been stored or processed by the appliance, especially if exploitation cannot be confidently ruled out.

How to confirm the fix worked

Confirm exposure by inventorying SonicWall SRA/SMA appliances and verifying model and firmware versions from the administrative interface, appliance CLI, configuration backup, asset inventory, or authenticated vulnerability scanner. Any appliance running SRA 8.x firmware or 9.0.0.9-26sv or earlier should be considered vulnerable. Validate remediation by confirming the vulnerable appliance is decommissioned, replaced, or upgraded to a supported unaffected firmware line, and that external scanning no longer identifies the affected SRA portal or vulnerable firmware. Also verify that administrative and VPN portals are not exposed broadly to the internet unless required and protected by current supported software. Run post-remediation vulnerability scans and review perimeter firewall rules, DNS records, and certificate transparency records to ensure no forgotten legacy SRA endpoints remain reachable.

Typical attack path

1. Scan the internet or target address ranges for exposed SonicWall SRA/SMA remote-access portals.
2. Fingerprint the appliance model, portal behavior, and firmware generation to identify end-of-life 8.x or vulnerable 9.0.0.9-26sv-or-earlier deployments.
3. Send crafted unauthenticated HTTP requests containing SQL injection payloads to vulnerable web application parameters.
4. Use database error responses, timing behavior, or content differences to confirm SQL injection.
5. Enumerate or extract sensitive appliance data such as users, authentication artifacts, configuration values, or session-related records where accessible.
6. Use obtained information to attempt VPN access, privilege escalation, persistence, or lateral movement.
7. Monetize access through data theft, extortion, ransomware deployment, or sale of remote-access footholds.

How to detect it

To determine whether exploitation already occurred, review SonicWall appliance logs, web access logs, reverse proxy logs, WAF events, perimeter firewall logs, VPN authentication logs, and SIEM-enriched identity events for the full period the appliance was internet-exposed. Look for unauthenticated HTTP requests to SRA/SMA portal paths containing SQL control characters, comments, stacked-query separators, time-delay functions, UNION-based extraction attempts, or database metadata references. Correlate these requests with application errors, HTTP 500 responses, unusual response sizes, repeated parameter fuzzing, or scanner-like request bursts. Review VPN and appliance authentication records after suspicious requests for successful logins from new geographies, unfamiliar autonomous systems, TOR/VPN hosting providers, impossible travel, newly created accounts, password changes, MFA changes, or administrative configuration changes. Because this vulnerability has been exploited in the wild and associated with ransomware activity, also hunt beyond the appliance for follow-on activity: new remote-access sessions, abnormal SMB/RDP/SSH use from VPN address pools, credential-dumping alerts, unusual PowerShell or command execution, mass file access, backup tampering, and ransomware staging. If logs are unavailable or truncated, treat unexplained exposure of vulnerable internet-facing firmware as a material incident risk and consider credential rotation and broader compromise assessment.

• UNION SELECT
• UNION ALL SELECT
• information_schema
• SLEEP(
• BENCHMARK(
• WAITFOR DELAY
• ' OR '1'='1
• " OR "1"="1
• OR 1=1
• AND 1=1
• --
• /*
• */
• ;SELECT
• ;DROP
• sqlmap
• You have an error in your SQL syntax
• mysql_fetch
• ODBC SQL Server Driver
• ORA-01756
• SQLite/JDBCDriver
• HTTP 500

What your security team should do

• Prioritize immediate removal or replacement of affected end-of-life SonicWall SRA appliances, especially internet-facing systems, because this vulnerability is in CISA KEV and associated with ransomware activity.
• Perform an emergency inventory for SonicWall SRA 1600, SRA 4600, SRA Virtual Appliance, SMA 210, SMA 410, and SMA 500v deployments and verify firmware versions.
• Assume affected internet-facing appliances may have been probed or exploited; preserve logs before rebooting, wiping, or replacing devices.
• Rotate VPN, local appliance, administrative, and service credentials after remediation, particularly for accounts that authenticated through the appliance during the exposure window.
• Review VPN authentication logs for unusual successful logins, impossible travel, unfamiliar source IPs, disabled MFA events, and new or modified accounts.
• Hunt for SQL injection attempts in appliance, reverse proxy, WAF, and perimeter logs using SQL metacharacters, database error strings, and automated scanner user agents.
• Restrict remote-access appliance exposure to approved source networks and require MFA on all remote-access users.
• If exploitation is suspected, perform incident response on downstream systems reachable from the VPN, not only on the appliance itself.
• Document compensating controls and residual risk if replacement cannot be completed immediately, but treat them as temporary only.