Exploited vulnerability · CISA KEV

Is CVE-2021-20021 exploited? Yes: in CISA KEV since 3 Nov 2021

Gociux · SonicWall Email Security · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2021-20021, SonicWall Email Security Improper Privilege Management Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 3 Nov 2021, 208 days after it was published. It is known to be used in ransomware campaigns. It affects SonicWall Email Security, an internet-facing product of the kind attackers use for initial access. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.

What to do

1. Check whether you run it. Look for SonicWall Email Security in your asset inventory, including appliances and cloud images. Stack check lists every exploited SonicWall CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 9 Apr 2021.
4. Get told next time. Email alerts when CISA adds a CVE for SonicWall.

Other exploited CVEs in SonicWall Email Security

• CVE-2021-20022: SonicWall Email Security Unrestricted Upload of File Vulnerability (3 Nov 2021)
• CVE-2021-20023: SonicWall Email Security Path Traversal Vulnerability (3 Nov 2021)

References

• nvd.nist.gov/vuln/detail/CVE-2021-20021

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in November 2021 · SonicWall scorecard · act-now radar.