CVE-2021-20028: SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 30.1% chance of exploitation in the next 30 days.

Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier

Affected products

• SonicWall SMA 210 Firmware: from 8.0.0.0, before 9.0.0.10-28sv (fixed in 9.0.0.10-28sv)
• SonicWall SMA 410 Firmware: from 8.0.0.0, before 9.0.0.10-28sv (fixed in 9.0.0.10-28sv)
• SonicWall SMA 500v Firmware: from 8.0.0.0, before 9.0.0.10-28sv (fixed in 9.0.0.10-28sv)
• SonicWall SRA 1600 Firmware: from 8.0.0.0, before 9.0.0.10-28sv (fixed in 9.0.0.10-28sv)
• SonicWall SRA 4600 Firmware: from 8.0.0.0, before 9.0.0.10-28sv (fixed in 9.0.0.10-28sv)
• SonicWall SRA Va Firmware: from 8.0.0.0, before 9.0.0.10-28sv (fixed in 9.0.0.10-28sv)

Published 2021-08-04. Last modified 2026-06-17.