CVE-2021-20021

CRITICAL KEV RANSOMWARE NUCLEI

SonicWall Email Security < 10.0.9.6103 - Unauthenticated Administrative Account Creation via Crafted HTTP Request

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2021-20021 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns. EIP tracks 1 public exploit from researchers including SUPRAAA-1337. A Nuclei detection template is also available.

AI-analyzed exploit summary The repository contains a Nuclei template for detecting CVE-2021-20021, an administrative account creation vulnerability in SonicWall Email Security. It sends a crafted HTTP request to check for the presence of the vulnerability by matching a specific error response.

Description

A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.

Exploits (1)

nomisec SCANNER 2 stars
by SUPRAAA-1337 · poc
https://github.com/SUPRAAA-1337/CVE-2021-20021

The repository contains a Nuclei template for detecting CVE-2021-20021, an administrative account creation vulnerability in SonicWall Email Security. It sends a crafted HTTP request to check for the presence of the vulnerability by matching a specific error response.

Classification
Scanner 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: SonicWall Email Security version 10.0.9.x
No auth needed
Prerequisites: Network access to the target system
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Nuclei Templates (1)

SonicWall Email Security <= 10.0.9.x - Unauthenticated Admin Account Creation
CRITICALVERIFIEDby pussycat0x
Shodan: product:"SonicWALL Email Security"

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.8343
EPSS Percentile 99.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable yes
Technical Impact total

Details

CISA KEV 2021-11-03
VulnCheck KEV 2021-04-20
InTheWild.io 2021-04-20
ENISA EUVD EUVD-2021-7484
Ransomware Use Confirmed
CWE
CWE-269
Status published
Products (11)
sonicwall/email_security < 10.0.9.6103
sonicwall/email_security_appliance_3300_firmware < 10.0.9.6105
sonicwall/email_security_appliance_4300_firmware < 10.0.9.6105
sonicwall/email_security_appliance_5000_firmware < 10.0.9.6105
sonicwall/email_security_appliance_5050_firmware < 10.0.9.6105
sonicwall/email_security_appliance_7000_firmware < 10.0.9.6105
sonicwall/email_security_appliance_7050_firmware < 10.0.9.6105
sonicwall/email_security_appliance_8300_firmware < 10.0.9.6105
sonicwall/email_security_appliance_9000_firmware < 10.0.9.6105
sonicwall/email_security_virtual_appliance < 10.0.9.6105
... and 1 more
Published Apr 09, 2021
KEV Added Nov 03, 2021
Tracked Since Feb 18, 2026