CVE-2021-20016: SonicWall SSLVPN SMA100 SQL Injection Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 40% chance of exploitation in the next 30 days.

A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.

Affected products

• SonicWall SMA 100 Firmware: from 10.0.0.0, before 10.2.0.5-d-29sv (fixed in 10.2.0.5-d-29sv)
• SonicWall SMA 200 Firmware: affected versions not specified
• SonicWall SMA 210 Firmware: affected versions not specified
• SonicWall SMA 400 Firmware: affected versions not specified
• SonicWall SMA 410 Firmware: affected versions not specified
• SonicWall SMA 500v: affected versions not specified

Published 2021-02-04. Last modified 2026-08-12.