SonicWall Email Security Appliance 4300 Firmware vulnerabilities

3 CVEs affecting SonicWall Email Security Appliance 4300 Firmware, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-20023, published 2021-04-20.

More from SonicWall.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-20021: SonicWall Email Security Improper Privilege Management Vulnerability, published 2021-04-09. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 88.8% chance of exploitation in the next 30 days. A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
• CVE-2021-20023: SonicWall Email Security Path Traversal Vulnerability, published 2021-04-20. Medium severity, CVSS 4.9. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 51.7% chance of exploitation in the next 30 days. SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
• CVE-2021-20022: SonicWall Email Security Unrestricted Upload of File Vulnerability, published 2021-04-09. High severity, CVSS 7.2. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 16.6% chance of exploitation in the next 30 days. SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.