CVE-2021-20022

This vulnerability lets an attacker who has already logged in upload a file of their choice to your SonicWall email security system. Think of it like a logged-in person being able to upload a “package” that the system then places on the server—if that package contains malicious content, it can help attackers take over the system or plant malware.

This matters if your business runs SonicWall Email Security or any of the listed SonicWall Email Security Appliance models (9000/3300/4300/8300/5000/7000/5050/7050), or uses Hosted Email Security / Email Security Virtual Appliance. Because this is post-authentication and has been used in ransomware campaigns, it’s a serious risk where an attacker can gain valid access to the system. It’s specifically relevant when the attacker already has login access to the Email Security interface (or otherwise can authenticate).

This is RED because CISA added CVE-2021-20022 to its Known Exploited Vulnerabilities list, and it has been used in ransomware campaigns. Since the weakness is an arbitrary file upload after authentication, attackers can use it to place malicious files on the email security host.

1. Inventory and exposure check

• Identify which product you run: SonicWall Email Security, Hosted Email Security, Email Security Appliance 9000/3300/4300/8300/5000/7000/5050/7050 firmware, or Email Security Virtual Appliance.
• Record the exact installed version (10.0.9.x family is the key for this issue).

2. Confirm whether you need the upgrade

• If your version is within 10.0.9.x and you have not applied the fixed update, treat you as affected.
• Because this issue is in CISA KEV with real-world ransomware usage, do not wait for additional evidence.

3. Apply the vendor-fixed versions (by product)

• SonicWall Email Security → fixed in 10.0.9.6103
• SonicWall Email Security Appliance models (9000/3300/4300/8300/5000/7000/5050/7050) → fixed in 10.0.9.6105
• SonicWall Email Security Virtual Appliance → fixed in 10.0.9.6105
• Hosted Email Security → fixed in 10.0.9.6103

4. Upgrade notes / breaking-change awareness

• Plan a maintenance window as needed for appliance/host upgrades (email security services may require a restart or re-initialization depending on your deployment).
• After upgrading, verify the system reports the new fixed version and that email security services are operating normally.

5. If you cannot patch immediately

• Contact SonicWall support and follow the vendor remediation guidance referenced for SNWLID-2021-0008 until you complete the upgrade.

6. What to monitor

• Look for signs of unauthorized authenticated activity (e.g., unexpected admin/user logins) and investigate any recent file-upload related events around the time of the suspicious activity.
• Review logs for abnormal administrative actions and any newly created/changed files associated with the email security application.

7. KEV timing

• CISA’s remediation due date for KEV entry was 2021-11-17 (already passed), so prioritize scheduling the fixed upgrade now.

CVE-2021-20022 affects SonicWall Email Security version 10.0.9.x and allows a post-authenticated attacker to upload an arbitrary file to the remote host (CWE-434: Unrestricted Upload of File with Dangerous Type). Mechanism: an authenticated attacker can leverage the email security system’s upload functionality to place attacker-controlled files onto the server, which can enable follow-on compromise (e.g., malicious payload staging) leading to impact consistent with ransomware activity.

Exploitation status: Confirmed in the real world—this CVE is included in CISA’s KEV list and has been used in ransomware campaigns (add date 2021-11-03). That status should be treated as a strong indicator of active attacker interest.

Patch availability: Fixed versions are available (Email Security fixed in 10.0.9.6103; all listed Email Security Appliance models fixed in 10.0.9.6105; Email Security Virtual Appliance fixed in 10.0.9.6105; Hosted Email Security fixed in 10.0.9.6103).

Exploit maturity: No public exploit code was found in the provided findings, but real-world exploitation is confirmed via KEV.

EPSS: A prediction is reported (trend flat). Per the provided guidance, this should not be used to downgrade urgency because KEV confirms exploitation.