Unrestricted File Upload in SonicWall Email Security (CVE‑2021‑20022) Enables Privilege Escalation
What It Is – SonicWall Email Security suffers an unrestricted file‑upload flaw that lets a post‑authenticated attacker place a malicious file on the appliance. The uploaded file can be chained with CVE‑2021‑20021 and CVE‑2021‑20023 to achieve privilege escalation.
Exploitability – The vulnerability is publicly disclosed, has been weaponised in exploit‑chains, and can be triggered by any attacker who obtains valid credentials. CVSS v3.1 base score: 7.8 (High).
Affected Products – SonicWall Email Security (all supported versions prior to the vendor‑issued patch).
Why It Matters for Trust & Control Assurance
- Continuous monitoring of third‑party patch status is a core control for demonstrating due‑diligence to auditors and customers.
- Evidence of timely remediation (patch‑application logs, configuration baselines) provides a defensible audit trail across frameworks.
- A compromised email gateway can undermine downstream data‑loss‑prevention and logging controls, eroding the overall trust posture of the organization.
Recommended Actions
- Verify your SonicWall Email Security version and apply the vendor’s security patch immediately.
- Review and harden file‑upload settings (restrict allowed MIME types, enforce content‑type validation).
- Enable and monitor detailed upload logs; integrate them with your SIEM for anomalous activity detection.
- Update your third‑party risk register to reflect the remediation status and schedule periodic verification.
- Document the remediation steps as evidence for control‑mapping audits.
Source: CISA KEV – CVE‑2021‑20022