CVE-2021-20028

CVE-2021-20028 is a SQL injection flaw (CWE-89) in SonicWall's Secure Remote Access (SRA) appliances, caused by improper neutralization of SQL commands processed by the device. An attacker who sends crafted input to the appliance's web-facing interface can inject SQL and read or manipulate the backend database, potentially extracting credentials or gaining a foothold on the gateway. Any organization still running the legacy, end-of-life SonicWall SRA remote-access product line is affected, and because these devices are remote-access gateways they are typically internet-exposed by design. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-28 with known ransomware use, and EPSS assigns a 29.9% probability of exploitation in the next 30 days (98th percentile). No public proof-of-concept is known, no CVSS score has been published, and the source data does not specify affected firmware versions.

What to do: Because CISA lists the impacted product as end-of-life with the required action to disconnect it, any organization still running an SRA appliance should decommission it and migrate to a supported SonicWall Secure Mobile Access (SMA) platform. If immediate replacement is not possible, restrict exposure of the appliance's web interface, apply the latest available SRA firmware if one is offered, and review logs for signs of SQL injection exploitation or follow-on ransomware activity.