CVE-2021-20021: SonicWall Email Security Improper Privilege Management Vulnerability

Vulnerability summary

CVE-2021-20021 is a critical (CVSS 9.8) Improper Privilege Management vulnerability in SonicWall SonicWall Email Security. It is known to be exploited: CISA lists it, first on 03-11-2021. It has been used in ransomware campaigns. EPSS estimates a 88.78% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities.

Timeline

1. 09-04-2021
   PublishedVulnerability first disclosed.
2. 03-11-2021
   Added to CISA KEVSonicWall Email Security Improper Privilege Management Vulnerability
3. 17-11-2021
   CISA remediation dueApply updates per vendor instructions.
4. 12-08-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.