SonicWall Email Security Virtual Appliance vulnerabilities

4 CVEs affecting SonicWall Email Security Virtual Appliance, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-20025, published 2021-05-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-20021: SonicWall Email Security Improper Privilege Management Vulnerability, published 2021-04-09. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 88.8% chance of exploitation in the next 30 days. A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
CVE-2021-20023: SonicWall Email Security Path Traversal Vulnerability, published 2021-04-20. Medium severity, CVSS 4.9. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 51.7% chance of exploitation in the next 30 days. SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
CVE-2021-20022: SonicWall Email Security Unrestricted Upload of File Vulnerability, published 2021-04-09. High severity, CVSS 7.2. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 16.6% chance of exploitation in the next 30 days. SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.
CVE-2021-20025, published 2021-05-13. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at initial setup. An attacker could exploit this…