Exploited vulnerability · CISA KEV

Is CVE-2021-20023 exploited? Yes: in CISA KEV since 3 Nov 2021

Gociux · SonicWall Email Security · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2021-20023, SonicWall Email Security Path Traversal Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 3 Nov 2021, 197 days after it was published. It is known to be used in ransomware campaigns. It affects SonicWall Email Security, an internet-facing product of the kind attackers use for initial access. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.

What to do

1. Check whether you run it. Look for SonicWall Email Security in your asset inventory, including appliances and cloud images. Stack check lists every exploited SonicWall CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 20 Apr 2021.
4. Get told next time. Email alerts when CISA adds a CVE for SonicWall.

Other exploited CVEs in SonicWall Email Security

• CVE-2021-20021: SonicWall Email Security Improper Privilege Management Vulnerability (3 Nov 2021)
• CVE-2021-20022: SonicWall Email Security Unrestricted Upload of File Vulnerability (3 Nov 2021)

References

• nvd.nist.gov/vuln/detail/CVE-2021-20023

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in November 2021 · SonicWall scorecard · act-now radar.