Hard-coded credentials in SonicWall Email Security Virtual Appliance
Priority LOW 34CWE-798Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.
Summary
SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at initial setup. An attacker could exploit this transitional/temporary user account from the trusted domain to access the Virtual Appliance remotely only when the device is freshly installed and not connected to Mysonicwall.
Why it matters now
EPSS 0.00356 29th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-20025
- 2026-10-03 Alias added: GHSA-cxhc-5wv5-j4r5
References
More SonicWall Email Security Virtual Appliance vulnerabilities
- TI-2021-03342 Improper privilege management in SonicWall Email Security KEVCVSS 3.1CRITICAL 9.8
- TI-2021-03343 Unrestricted file upload in SonicWall Email Security KEVCVSS 3.1HIGH 7.2
- TI-2021-03344 Path traversal in SonicWall Email Security KEVCVSS 3.1MEDIUM 4.9
Sources
- CVE-2021-20025 · CVE Program
- CVE-2021-20025 · NVD
- FIRST EPSS
- GHSA-cxhc-5wv5-j4r5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences