{"id":"CVE-2021-20021","title":"A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.","summary":"A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-269","CWE-269"],"vendor":"sonicwall","product":"email_security","affected":["email_security < 10.0.9.6103","email_security_appliance_9000_firmware < 10.0.9.6105","email_security_appliance_3300_firmware < 10.0.9.6105","email_security_appliance_4300_firmware < 10.0.9.6105","email_security_appliance_8300_firmware < 10.0.9.6105","email_security_appliance_5000_firmware < 10.0.9.6105","email_security_appliance_7000_firmware < 10.0.9.6105","email_security_appliance_5050_firmware < 10.0.9.6105","email_security_appliance_7050_firmware < 10.0.9.6105","email_security_virtual_appliance < 10.0.9.6105","hosted_email_security < 10.0.9.6103"],"patched":["email_security 10.0.9.6103","email_security_appliance_9000_firmware 10.0.9.6105","email_security_appliance_3300_firmware 10.0.9.6105","email_security_appliance_4300_firmware 10.0.9.6105","email_security_appliance_8300_firmware 10.0.9.6105","email_security_appliance_5000_firmware 10.0.9.6105","email_security_appliance_7000_firmware 10.0.9.6105","email_security_appliance_5050_firmware 10.0.9.6105","email_security_appliance_7050_firmware 10.0.9.6105","email_security_virtual_appliance 10.0.9.6105","hosted_email_security 10.0.9.6103"],"published":"2021-04-09","updated":"2026-08-12","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-20021","references":[{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0007","label":"PSIRT@sonicwall.com"},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0007","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20021","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild","exploit-available"],"epss":0.8867,"epssPercentile":0.99771,"kev":true,"kevDateAdded":"2021-11-03","kevDueDate":"2021-11-17","kevRansomware":true,"exploited":true,"ingestedAt":"2026-08-12T19:54:25.883Z","exploits":{"github":1,"githubRepos":["https://github.com/SUPRAAA-1337/CVE-2021-20021"],"nuclei":["CVE-2021-20021"],"checkedAt":"2026-09-25T08:20:37.823Z"},"exploitAvailable":true,"slug":"CVE-2021-20021","body":"## Overview\n\nA vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.\n\n## Affected\n\n- `email_security < 10.0.9.6103`\n- `email_security_appliance_9000_firmware < 10.0.9.6105`\n- `email_security_appliance_3300_firmware < 10.0.9.6105`\n- `email_security_appliance_4300_firmware < 10.0.9.6105`\n- `email_security_appliance_8300_firmware < 10.0.9.6105`\n- `email_security_appliance_5000_firmware < 10.0.9.6105`\n- `email_security_appliance_7000_firmware < 10.0.9.6105`\n- `email_security_appliance_5050_firmware < 10.0.9.6105`\n- `email_security_appliance_7050_firmware < 10.0.9.6105`\n- `email_security_virtual_appliance < 10.0.9.6105`\n- `hosted_email_security < 10.0.9.6103`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `email_security 10.0.9.6103`\n- `email_security_appliance_9000_firmware 10.0.9.6105`\n- `email_security_appliance_3300_firmware 10.0.9.6105`\n- `email_security_appliance_4300_firmware 10.0.9.6105`\n- `email_security_appliance_8300_firmware 10.0.9.6105`\n- `email_security_appliance_5000_firmware 10.0.9.6105`\n- `email_security_appliance_7000_firmware 10.0.9.6105`\n- `email_security_appliance_5050_firmware 10.0.9.6105`\n- `email_security_appliance_7050_firmware 10.0.9.6105`\n- `email_security_virtual_appliance 10.0.9.6105`\n- `hosted_email_security 10.0.9.6103`","depth":"hadal","depthScore":100,"depthScoreParts":{"impact":53.9,"likelihood":17.7,"exploitation":25,"ransomware":5},"changes":[{"seq":210704,"id":"CVE-2021-20021","ts":1790324582754,"field":"epss","old":"0.83425","new":"0.8867"},{"seq":4500,"id":"CVE-2021-20021","ts":1788887185895,"field":"exploit_available","old":"false","new":"true"},{"seq":3383,"id":"CVE-2021-20021","ts":1788886303622,"field":"exploit_available","old":"true","new":"false"},{"seq":2238,"id":"CVE-2021-20021","ts":1788882973261,"field":"exploit_available","old":"false","new":"true"},{"seq":1267,"id":"CVE-2021-20021","ts":1788882384914,"field":"exploit_available","old":"true","new":"false"},{"seq":381,"id":"CVE-2021-20021","ts":1788881820233,"field":"exploit_available","old":"false","new":"true"}]}