CVE-2021-20022 – CVE-2021-20022 is a post-authentication arbitra... (How to Fix)

Q: What is the severity of CVE-2021-20022?

CVE-2021-20022 has a CVSS score of 7.2 (HIGH). CVE-2021-20022 is a post-authentication arbitrary file upload vulnerability in SonicWall Email Security. An authenticated attacker can upload malicious files to the remote host, potentially leading to remote code execution. Organizations running affected SonicWall Email Security versions are at risk.

📋 TL;DR

CVE-2021-20022 is a post-authentication arbitrary file upload vulnerability in SonicWall Email Security. An authenticated attacker can upload malicious files to the remote host, potentially leading to remote code execution. Organizations running affected SonicWall Email Security versions are at risk.

💻 Affected Systems

Products:

SonicWall Email Security

Versions: 10.0.9.x versions

Operating Systems: SonicWall proprietary OS

Default Config Vulnerable: ⚠️ Yes

Notes: Requires attacker to have valid authentication credentials to exploit.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise via remote code execution, allowing attacker to install malware, exfiltrate data, or pivot to other network systems.

🟠

Likely Case

Attacker uploads web shell or malicious payload to gain persistent access and execute commands on the vulnerable system.

🟢

If Mitigated

Limited impact with proper network segmentation, file upload restrictions, and monitoring in place.

🌐 Internet-Facing: HIGH - Email security appliances are typically internet-facing, making them prime targets for exploitation.

🏢 Internal Only: MEDIUM - Internal attackers with valid credentials could exploit this vulnerability.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires valid credentials but is straightforward once authenticated. CISA has added this to its Known Exploited Vulnerabilities catalog.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 10.0.9.6103 and later

Vendor Advisory: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0008

Restart Required: Yes

Instructions:

1. Log into SonicWall Email Security management interface. 2. Navigate to System > Updates. 3. Check for and apply available updates. 4. Reboot the appliance after update completion.

🔧 Temporary Workarounds

Restrict File Upload Types

all

Configure SonicWall Email Security to only allow specific file types for upload if supported by the platform.

Network Segmentation

all

Isolate SonicWall Email Security appliance from critical internal networks to limit potential lateral movement.

🧯 If You Can't Patch

Implement strict access controls and monitor for suspicious authentication attempts
Deploy network-based intrusion detection to monitor for file upload anomalies

🔍 How to Verify

Check if Vulnerable:

Check SonicWall Email Security version via web interface: System > About. If version is 10.0.9.x and below 10.0.9.6103, system is vulnerable.

Check Version:

No CLI command available - check via web interface at System > About

Verify Fix Applied:

Verify version is 10.0.9.6103 or later in System > About page.

📡 Detection & Monitoring

Log Indicators:

Unusual file upload activity in application logs
Multiple failed authentication attempts followed by successful login and file upload

Network Indicators:

Unexpected outbound connections from SonicWall appliance
HTTP POST requests with file uploads to unusual paths

SIEM Query:

source="sonicwall-email" AND (event_type="file_upload" OR action="upload") AND file_extension IN ("php", "jsp", "asp", "exe", "bat")

📊 Metadata

CVE ID: CVE-2021-20022

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-434

Published: April 9, 2021

Last Updated: November 10, 2025

🔗 References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0008 Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0008 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20022 US Government Resource

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-20022, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Email Security by Sonicwall

Email Security Appliance 3300 Firmware by Sonicwall

Email Security Appliance 4300 Firmware by Sonicwall

Email Security Appliance 5000 Firmware by Sonicwall

Email Security Appliance 5050 Firmware by Sonicwall

Email Security Appliance 7000 Firmware by Sonicwall

Email Security Appliance 7050 Firmware by Sonicwall

Email Security Appliance 8300 Firmware by Sonicwall

Email Security Appliance 9000 Firmware by Sonicwall

Email Security Virtual Appliance by Sonicwall

Hosted Email Security by Sonicwall