WaratekVRT Sign in

CVE-2021-20022 SonicWall Email Security

Affected softwareSonicWall Email Security
Severity7.2 High CVSS 3.1 3 scores
WeaknessUnrestricted file upload (CWE-434)
Published9 Apr 2021
Updated1 Oct 2026

Description

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2021-11-03 · remediation due 2021-11-17 · ransomware use: known
  • VulnCheck KEV listed Exploitation reported in the wild. 7 citations · earliest 2021-04-20.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC none indexed
  • EPSS 17% chance in 30 days A model's forecast, not a report of exploitation. Higher than 97% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2021-20022 in VulnCheck (free account), which lists 2 more citations not shown here.

EvidenceSourceDetailDate
Reported exploitation cloud.google.com /blog/topics/threat-intelligence/zero-day-exploits-in-sonicwall-email-security-lead-to-compromise 2021-04-20
Reported exploitation fireeye.com /blog/threat-research/2021/04/zero-day-exploits-in-sonicwall-email-security-lead-to-compromise.html 2021-04-20
Reported exploitation ic3.gov /Media/News/2021/211029.pdf 2021-10-28
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2021-11-03
Reported exploitation cybersecurityworks.com /howdymanage/uploads/file/Spotlight%20Report%20-%20Index%20Update%20Q2%20-%20Q3%20-%20Final%20Version_compressed.pdf 2022-05-18

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review automated Upstream data
  • Record active
Decided by The only affected product being a sealed appliance image, where Java runs but no -javaagent can be attached
Finding This CVE names only products the Waratek agent cannot be installed into (sonicwall/email_security). They ship as sealed appliance images or as native code with no application JVM, so there is no start-up line to add -javaagent to. The vulnerability may well be a Java one; it is permanently out of ARMR's reach rather than outside its subject.

CVSS

7.2 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Products and versions

11 products, 11 version entries
SourceVendorProductSchemeAffected versions
nvd sonicwall email security generic ＜ 10.0.9.6103
nvd sonicwall email security appliance 3300 firmware generic ＜ 10.0.9.6105
nvd sonicwall email security appliance 4300 firmware generic ＜ 10.0.9.6105
nvd sonicwall email security appliance 5000 firmware generic ＜ 10.0.9.6105
nvd sonicwall email security appliance 5050 firmware generic ＜ 10.0.9.6105
nvd sonicwall email security appliance 7000 firmware generic ＜ 10.0.9.6105
nvd sonicwall email security appliance 7050 firmware generic ＜ 10.0.9.6105
nvd sonicwall email security appliance 8300 firmware generic ＜ 10.0.9.6105
nvd sonicwall email security appliance 9000 firmware generic ＜ 10.0.9.6105
nvd sonicwall email security virtual appliance generic ＜ 10.0.9.6105
nvd sonicwall hosted email security generic ＜ 10.0.9.6103

References

URLTags
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0008 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20022 US Government Resource

Timeline
Published2021-04-09By the CVE Program.
VulnCheck KEV: earliest evidence2021-04-20Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2021-11-03Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: latest evidence2023-07-18Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-10-01NVD's own last-modified date for this record.