CVE-2021-20016

State: Published
Severity: 9.8 Critical
Published: Feb 3, 2021
Updated: Aug 12, 2026
Reserved: Dec 17, 2020

Description

A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
SonicWall SMA100SonicWall	SMA100 build version 10.xAffected

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20016government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.