Administrative Account Creation in SonicWall Email Security 10.0.9.x

Successful exploitation allows an attacker to establish unauthorized administrative access to the SonicWall Email Security instance by creating a new administrator account. This can provide durable control over the product, enable access to configuration and account data, facilitate deployment of web shells or other post-exploitation tooling, and support follow-on actions such as credential theft, data access, and lateral movement from the affected host.

Apply the vendor-provided hotfix/patch or upgrade to the fixed versions identified by SonicWall. Until patching is completed, reduce exposure of the management interface to untrusted networks, monitor for unexpected administrator account creation, review SonicWall ES configuration/account files and Tomcat logs for suspicious activity, monitor for child processes spawned by the Tomcat web server process such as cmd.exe, and inspect for web shells or other unauthorized files on the server. Review the SonicWall web UI log and related artifacts for evidence of tampering or log clearing.

Upgrade SonicWall Email Security to a fixed release. The provided content states that Mandiant and SonicWall recommended upgrading to version 10.0.9.6173 for Windows deployments or 10.0.9.6177 for Hardware and ESXi deployments to mitigate CVE-2021-20021 along with related issues CVE-2021-20022 and CVE-2021-20023. SonicWall Hosted Email Security customers were automatically updated and required no action.