Actively exploited in the wild
SonicWall Email Security Improper Privilege Management Vulnerability
SonicWall - SonicWall Email Security · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-20021
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
Risk Assessment
An attacker can gain unauthorized administrative access to the email security system, potentially leading to compromise of message confidentiality and integrity, and system takeover.
Recommendation
Update SonicWall Email Security to the latest available version that includes the fix.
Original NVD description (English source)
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.