Improper Privilege Management in SonicWall Email Security (CVE‑2021‑20021) Enables Admin Account Creation
What It Is – SonicWall Email Security contains an improper privilege‑management flaw that lets an unauthenticated attacker create a new administrative account by sending a crafted HTTP request. The issue is chained with CVE‑2021‑20022 and CVE‑2021‑20023 to achieve full privilege escalation.
Exploitability – Public exploit code exists; the vulnerability is rated Critical (CVSS ≈ 9.8) and can be weaponised without prior access.
Affected Products – SonicWall Email Security (all versions prior to the vendor‑released patch).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous privileged‑account monitoring and evidence of timely patching as core control‑assurance activities.
- Highlights gaps in access‑control governance that auditors will scrutinise when evaluating the organization’s security posture.
- Provides a concrete example of why enterprises must maintain defensible audit trails for privileged‑account creation and changes.
Recommended Actions
- Apply SonicWall’s latest security patch for CVE‑2021‑20021 immediately.
- Conduct a privileged‑account review: verify that no unauthorized admin accounts exist and that all admin actions are logged.
- Strengthen web‑application firewall rules to block malformed HTTP requests targeting the vulnerable endpoint.
- Integrate the patch‑management event into your continuous control‑monitoring platform to retain evidence for audit readiness.
Source: CISA KEV – CVE‑2021‑20021