Critical SQL Injection in SonicWall Secure Remote Access (SRA) – CVE‑2021‑20028
What It Is — SonicWall Secure Remote Access (SRA) appliances contain an improper neutralization of SQL commands, allowing an attacker to inject arbitrary SQL queries. The flaw can be triggered remotely over the Internet.
Exploitability — The vulnerability is publicly disclosed, proof‑of‑concept code is available, and the CVSS v3.1 base score is 9.8 (Critical). No patch was available at the time of disclosure; SonicWall has since released a security update.
Affected Products — All SonicWall Secure Remote Access (SRA) devices running firmware versions prior to the vendor‑issued patch (see SonicWall advisory).
Why It Matters for Trust & Control Assurance
- Vulnerability Management – Demonstrates the need for continuous scanning and timely patching to satisfy the control objective of maintaining a robust vulnerability‑remediation process.
- Audit Evidence – Remediating this flaw and retaining proof (patch logs, scan reports) provides defensible evidence for audits aligned with NIST CSF 2.0 and other frameworks.
- Supply‑Chain Assurance – Third‑party network appliances are part of the enterprise attack surface; their security posture must be continuously verified to uphold a trustworthy supply chain.
Recommended Actions
- Apply the SonicWall SRA security patch immediately and verify the firmware version.
- Update your asset inventory to flag all SRA devices and confirm they are covered by your vulnerability‑management schedule.
- Run an authenticated scan against the SRA endpoints to ensure the injection vector is closed.
- Document remediation steps and retain logs as evidence for compliance audits.
Source: CISA KEV – CVE‑2021‑20028