#VU53230 Use of hard-coded credentials in SonicWall On-premise Email Security (ES) and SonicWall Hosted Email Security (HES) - CVE-2021-20025

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU53230

#VU53230 Use of hard-coded credentials in SonicWall On-premise Email Security (ES) and SonicWall Hosted Email Security (HES) - CVE-2021-20025

Published: May 13, 2021


Vulnerability identifier: #VU53230
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2021-20025
CWE-ID: CWE-798
Exploitation vector: Adjecent network
Exploit availability: No public exploit available
Vulnerable software:
SonicWall On-premise Email Security (ES)
SonicWall Hosted Email Security (HES)
Software vendor:
SonicWall

Description

The vulnerability allows a remote attacker to gain full access to vulnerable system.

The vulnerability exists due to presence of hard-coded credentials in application code, a default username and a password are used at initial setup. A remote unauthenticated attacker can access the Virtual Appliance using the default credentials only when the device is freshly installed and not connected to Mysonicwall.



Remediation

Install updates from vendor's website.

External links