Exploited vulnerability · CISA KEV

Is CVE-2021-20022 exploited? Yes: in CISA KEV since 3 Nov 2021

Gociux · SonicWall Email Security · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2021-20022, SonicWall Email Security Unrestricted Upload of File Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 3 Nov 2021, 208 days after it was published. It is known to be used in ransomware campaigns. It affects SonicWall Email Security, an internet-facing product of the kind attackers use for initial access. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.

What to do

1. Check whether you run it. Look for SonicWall Email Security in your asset inventory, including appliances and cloud images. Stack check lists every exploited SonicWall CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 9 Apr 2021.
4. Get told next time. Email alerts when CISA adds a CVE for SonicWall.

Other exploited CVEs in SonicWall Email Security

• CVE-2021-20021: SonicWall Email Security Improper Privilege Management Vulnerability (3 Nov 2021)
• CVE-2021-20023: SonicWall Email Security Path Traversal Vulnerability (3 Nov 2021)

References

• nvd.nist.gov/vuln/detail/CVE-2021-20022

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in November 2021 · SonicWall scorecard · act-now radar.