CVE-2021-20028

The vulnerability in question arises from improper neutralization of SQL commands, leading to a significant SQL injection risk in specific end-of-life Secure Remote Access (SRA) products. This flaw affects appliances running firmware versions 8.x and 9.0.0.9-26sv or earlier. SQL injection vulnerabilities occur when an application improperly validates or sanitizes user input, allowing an attacker to manipulate SQL queries executed by the database. In this case, the affected SRA products can be exploited to execute arbitrary SQL commands, potentially exposing sensitive data or allowing unauthorized access to the system.

Attack vectors for this vulnerability are varied and can be executed remotely, making it particularly dangerous. An attacker could craft malicious input that is processed by the vulnerable SQL queries, leading to unauthorized data retrieval, modification, or even deletion. Exploitation scenarios may include accessing user credentials, sensitive configuration data, or other critical information stored within the database. Given the nature of remote access appliances, an attacker could gain foothold into an organization's network, escalating privileges and compromising additional systems. The ease of exploitation, combined with the potential for significant data breaches, underscores the severity of this vulnerability.

The real-world impact of this vulnerability can be profound, particularly for organizations relying on the affected SRA products for secure remote access. The risk extends beyond mere data exposure; it can lead to financial losses, reputational damage, and regulatory penalties if sensitive information is compromised. Organizations may face operational disruptions as they scramble to mitigate the effects of an attack or to respond to regulatory inquiries. Furthermore, the end-of-life status of these products means that users may not receive timely updates or patches, exacerbating the risk and leaving systems vulnerable to ongoing exploitation.

To detect and mitigate this vulnerability, organizations should implement a multi-faceted approach. First, regular vulnerability assessments and penetration testing can help identify potential weaknesses in their systems. Monitoring for unusual database activity can also serve as an early warning system for exploitation attempts. Organizations should prioritize upgrading or replacing affected appliances with supported versions that have addressed this vulnerability. Additionally, employing web application firewalls (WAFs) can provide an additional layer of defense by filtering and monitoring HTTP requests, potentially blocking malicious input before it reaches the database.

In conclusion, the SQL injection vulnerability in specific Secure Remote Access products poses a significant threat to organizations that rely on these systems for secure connectivity. With the potential for severe consequences, including data breaches and operational disruptions, it is critical for organizations to take proactive measures to detect and mitigate this risk. By understanding the nature of the vulnerability, recognizing the attack vectors, assessing the real-world impact, and implementing robust detection and mitigation strategies, organizations can better protect themselves against the threats posed by this and similar vulnerabilities.

CSURFACE threat intelligence has detected a marked escalation in activity related to CVE-2021-20028, with telemetry indicating a doubling in detection frequency over recent monitoring periods. This uptick, while still limited in absolute terms, signals increased adversary interest and potential preparatory actions for broader exploitation campaigns. The persistence of ransomware groups such as Sinobi in association with this vulnerability underscores its continued attractiveness as a vector for intrusion and post-compromise operations. Although no new exploit variants have surfaced, the elevated detection trend heightens the urgency for defenders to maintain vigilant monitoring and reinforces the criticality of addressing this vulnerability in legacy Secure Remote Access deployments. Consequently, the threat level should be considered elevated from moderate to high, reflecting the growing likelihood of exploitation attempts that could lead to significant operational and data security impacts.

Update 2 — May 15, 2026

CSURFACE threat intelligence has detected a marked escalation in activity related to CVE-2021-20028, with telemetry indicating a sustained increase in exploitation attempts targeting legacy Secure Remote Access appliances. This upward trend is corroborated by a rising EPSS score, now approaching the upper percentile range, signaling heightened attacker interest and potential for successful compromise. The persistence of ransomware groups such as Sinobi in campaigns leveraging this vulnerability further amplifies its operational relevance. Although no novel exploit variants have been identified, the intensification of detection events underscores an evolving threat environment where adversaries continue to probe and exploit known weaknesses in end-of-life firmware. For defenders, this development signifies an elevated risk posture, necessitating increased vigilance in monitoring and response activities. Consequently, the threat level associated with CVE-2021-20028 should be reassessed as high, reflecting the growing probability of impactful exploitation that could disrupt critical infrastructure and data integrity.

Update 3 — May 23, 2026

CSURFACE threat intelligence has detected a marked escalation in activity related to CVE-2021-20028, with telemetry indicating a significant uptick in exploitation attempts targeting vulnerable SonicWall SRA appliances. Although the EPSS score shows a slight decline, the overall detection trend reflects increased adversary interest, particularly from ransomware-linked groups such as Sinobi. This resurgence in probing and exploitation attempts against end-of-life firmware underscores a persistent and evolving threat landscape where attackers continue to leverage this critical SQL injection vulnerability. For defenders, the heightened activity signals an increased likelihood of successful compromise, elevating the operational risk associated with unpatched or unsupported SRA devices. Consequently, the threat level for CVE-2021-20028 warrants reassessment to reflect a sustained high risk, emphasizing the need for ongoing situational awareness despite the absence of new exploit variants.