SonicWall Patches Zero-Day Flaw in Secure Mobile Access (CVE-2021-20016)

On February 3, SonicWall published a patch to address a zero-day vulnerability in its Secure Mobile Access (SMA) 100 series of remote access products. The vulnerability, identified as CVE-2021-20016, is a SQL injection flaw that was reportedly used to target SonicWall directly in January. 

Researchers at NCC Group observed a separate in-the-wild exploitation of the zero-day vulnerability at the end of January. Their findings were confirmed by SonicWall, and subsequently a patch was developed and released.

For more information about the vulnerability, including the availability of patches and Tenable product coverage, please visit our blog.