SonicWall · Secure Remote Access (SRA)
CVE-2021-20028
SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability
What it is
Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier
CISA: SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.
What to do
The impacted product is end-of-life and should be disconnected if still in use.
Deadline for US federal agencies: April 18, 2022
- Added to the CISA list
- March 28, 2022
- Published
- August 4, 2021
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 30% in the top 1.8% of all known vulnerabilities
- Weakness
- CWE-89
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from SonicWall
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 2, 2026 | Server-Side Request Forgery | SMA1000 Appliances | Critical 10.0 | 8.0% |
| Sep 2, 2026 | OS Command Injection | SMA1000 Appliances | High 7.8 | 9.9% |
| Jul 14, 2026 | Server-Side Request Forgery | SMA1000 Appliances | Critical 10.0 | 6.8% |
| Jul 14, 2026 | Code Injection | SMA1000 Appliances | High 7.2 | 12% |
| Dec 17, 2025 | SMA1000 Missing Authorization | SMA1000 appliance | Medium 6.6 | 2.8% |
| May 1, 2025 | OS Command Injection | SMA100 Appliances | High 7.2 | 76% |
| Apr 16, 2025 | OS Command Injection | SMA100 Appliances | Medium 6.5 | 4.4% |
| Feb 18, 2025 | SSLVPN Improper Authentication | SonicOS | High 8.2 | 95% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.