Days after the SolarWinds disclosure, researchers found another stealthy campaign: unknown actors exploiting a zero-day in SonicWall’s Secure Mobile Access (SMA) appliances — the third major edge-device campaign of early 2021, and an early sign that VPN and remote-access gear had become the primary beachhead for intrusion teams.
In mid-January 2021, researchers spotted attackers exploiting a then-unpatched SQL-injection flaw (CVE-2021-20016, CVSS 9.8) in SonicWall SMA 100-series appliances to read files and steal credentials, with evidence of exploitation against a SonicWall internal system and at least one customer. SonicWall confirmed the campaign on 22–23 January 2021 and issued patches through February. The durable lesson: management and remote-access edge appliances are tier-0 assets — attackers concentrate on them because one unauthenticated bug yields an enterprise foothold, and SSL-VPN credentials stolen this way feed ransomware crews within days.
What happened
On 15–16 January 2021, while the industry was still absorbing SUNBURST, threat researchers (including the NCC Group and later Microsoft) reported anomalous exploitation of SonicWall SMA 100 series devices — SSL-VPN remote-access appliances popular with mid-size enterprises. Attackers were chaining an unauthenticated SQL injection in the SMA management interface (later CVE-2021-20016) to extract contents including hashed and in some configurations readable credentials, then using them to log into VPNs that relied on password-only authentication.
SonicWall’s handling became its own subplot. On 22 January the company confirmed a “coordinated attack” on its internal systems, acknowledging its own Secure Remote Access environment had been targeted via the SMA flaw; two days later it issued a “critical” notice urging customers to apply mitigations for CVE-2021-20016 while a full patch was prepared. Patches shipped in tranches through February — SMA 8.0.0.4 for the 100-series on 2 February — yet researchers, and later CISA, continued to observe in-the-wild exploitation of unpatched units into spring, and SonicWall issued further advisories for related bugs including CVE-2021-20038 (stack buffer overflow, December 2021 patch) that the same or copycat crews probed.
Attribution stayed loose; the campaigns blended criminal access-brokering with possible state-adjacent scanning, and stolen SSL-VPN credentials resurfaced in ransomware incidents throughout 2021 — a pattern that repeated with Fortinet, Pulse Secure, Ivanti and Citrix that same year. SonicWall’s episode is best remembered as the second domino in the year the industry re-learned that the network edge is the new perimeter — and the new front door.
How it worked
The core flaw was an unauthenticated SQL injection reachable on the SMA appliance’s web management interface. By submitting crafted queries, an attacker could read arbitrary data from the appliance’s database — including the local user store. On affected firmware the store held password material in weakly protected form, and any account with VPN rights harvested this way was a direct enterprise foothold.
internet -> SMA 100 web mgmt interface (443)
-> unauthenticated SQLi (CVE-2021-20016)
-> read sma users table: usernames + password material
-> (no patch available Jan 2021) attacker retries at will
|
credentials valid on SSL-VPN
-> attacker logs in AS a real remote user (no malware yet)
-> MFA-less accounts -> direct internal network access
-> access brokers resell; ransomware affiliates detonate laterTwo structural points matter more than the specific bug. First, exploitation required no user interaction and left minimal traces on victim endpoints — the appliance was both the target and the pivot, so endpoint AV and EDR saw nothing until post-VPN activity began. Second, the campaign demonstrated credential-harvest economics: a single edge-device bug yields thousands of VPN entry points, each one login indistinguishable from a legitimate employee. This is the access-broker playbook that would define 2021–2026, and it still works wherever SSL-VPN fleets run unpatched or MFA-less.
Impact and numbers
| Metric | Value | Source |
|---|---|---|
| CVE identifier / severity | CVE-2021-20016, CVSS 9.8 Critical | SonicWall PSIRT advisory |
| Affected products | SMA 100 series (and related SRA end-of-life) | SonicWall security notices |
| SonicWall disclosure date | 2021-01-22 (internal attack confirmed 01-23) | SonicWall statements |
| Patch availability | SMA 10.2.0.7-31v / 8.0.0.4 tranches through Feb 2021 | SonicWall advisories |
| Exploitation observed | Pre-disclosure in the wild; ongoing against unpatched units into 2021-Q2 | firewall telemetry, CISA advisories |
| Follow-on edge CVEs same vendor | CVE-2021-20038 (SMA stack overflow) + SonicWall GMS/EMA bugs | SonicWall PSIRT 2021 series |
Timeline
| Date | Event |
|---|---|
| 2021-01-15/16 | Researchers detect anomalous SMA exploitation attempts |
| 2021-01-22 | SonicWall confirms attack on its own internal systems via SMA |
| 2021-01-25 | Critical notice: temporary mitigation guidance published |
| 2021-02-02 | Patch released for SMA 100 series (SQLi credential disclosure) |
| 2021-02–04 | CISA adds exploitation awareness; scanning of unpatched units continues |
| 2021-12 | SonicWall patches CVE-2021-20038 buffer overflow, also targeted on the edge |
Why it still matters in 2026
The SonicWall episode was an early entry in what became a permanent pattern: VPN and remote-access appliances are probed continuously, and every unpatched SSL-VPN fleet is a standing inventory of enterprise footholds. The 2023–2026 Barracuda, Ivanti and Fortinet crises replayed this script with bigger names. Defender programs now treat edge devices as tier-0: patched on emergency cycles, monitored for anomalous logins, and put behind phishing-resistant MFA so a stolen password is not a network key. Our analysis of the later SonicWall-linked Marquis breach continues this thread, and the broader edge-zero-day wave is covered in the zero-day surge retrospective.
Detection and hardening takeaways
- Patch edge appliances on an emergency SLA. Edge-device criticals are exploited within days — automate firmware tracking and stage out-of-cycle maintenance windows for SSL-VPN fleets.
- Enforce phishing-resistant MFA on all remote access. Credential extraction from an appliance database should not yield a working login; FIDO2/passkeys neutralise the stolen-password market.
- Monitor appliance-to-internal traffic. Post-VPN lateral movement is the first observable stage; baseline user-to-segment flows and alert on deviations.
- Log the edge device itself. Ship appliance syslogs and web-access logs off-box — the SMA campaigns were reconstructed entirely from appliance telemetry.
- Decommission end-of-life remote-access gear. Unpatchable SRA-era devices remained exposed targets for years after vendors moved on.
FAQ
Was the SonicWall campaign connected to SolarWinds?
No credible evidence links them. The timing overlapped, and SonicWall’s own internal investigation confirmed a separate, direct exploitation of the SMA flaw against its systems. Convergence of dates was coincidence — but both stories pushed the same 2021 realisation: trusted infrastructure, not endpoints, was the contested ground.
What should organisations have done the day the advisory landed?
Three moves: apply the vendor mitigation immediately (interface restrictions while awaiting patches), force credential rotation for all appliance-hosted accounts, and review VPN authentication logs back to mid-January for anomalous logins. Teams that did all three avoided follow-on incidents; those that treated it as “just a firewall bug” were disproportionately represented in later ransomware case studies.
Why do attackers concentrate on SSL-VPN appliances?
Economics: one unauthenticated bug equals thousands of potential enterprise footholds, the target runs with elevated network trust by design, appliances are often patched slower than servers, and a valid VPN login looks legitimate to most controls. Every year since 2021 has validated this calculus, which is why zero-trust roadmaps prioritise replacing implicit VPN network access.
