@blamejs/exceptd-skills 0.21.3 → 0.21.5

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.21.5 — 2026-09-27
+
+The catalog holds 1,754 CVEs after two additions from CISA KEV, both SonicWall flaws that carry CISA's ransomware designation: CVE-2021-20021, an improper privilege management flaw in SonicWall Email Security, and CVE-2021-20016, a SQL injection in the SMA 100 series SSL VPN. Neither has a public exploit, and both need a restart before the fix takes effect.
+
+## 0.21.4 — 2026-09-26
+
+`exceptd refresh --curate-batch` now refuses a batch whose new catalog entries or zero-day lessons cite the curation input instead of a source, as in "Packet: ...", "Packet fields: ...", "the packet names ...", "the packet's own ..." or "per the packet", and it writes nothing when it does. It checks every submitted entry and lesson, including one marked `_auto_imported`. The catalog gap audit has a matching `pipeline-wording` class: `npm run audit-catalog-gaps -- --class pipeline-wording` lists the 2,159 existing texts with that wording (2,157 lesson texts and 2 catalog fields), and the predeploy budget gate fails if the count grows. Wording about network packets, such as "packet data", "Packet fields are not validated", "the malformed packet: its length" or "the packet socket (AF_PACKET)", and the exploit archive Packet Storm do not match.
+
+`npm run audit-catalog-gaps -- --class` now accepts every class the gap detectors report.
+
 ## 0.21.3 — 2026-09-24
 
 The catalog holds 1,752 CVEs after 32 additions from CISA KEV. Twenty-one are Microsoft flaws, among them two links of the ProxyShell Exchange chain (CVE-2021-31207 and CVE-2021-34473), the CryptoAPI certificate-validation spoofing flaw CVE-2020-0601, the SharePoint deserialization flaw CVE-2019-0604, and Win32k, Common Log File System and Windows Error Reporting privilege escalations. Five are Oracle WebLogic Server and Oracle Coherence flaws, two are Firefox and Thunderbird use-after-free flaws, and the rest cover Arista VeloCloud Orchestrator, Nagios XI, PlaySMS and Progress Telerik UI for ASP.NET AJAX.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-09-24T17:32:31.224Z",
+  "generated_at": "2026-09-27T14:51:02.622Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "b57d31f96b49ed1cc418972797df9c088d418bde0f45ec9a77a2b3ac4c42f9eb",
+    "manifest.json": "02398f4bcc28238623b56128e7e517d6b33375360be62c7cf799b3896d1b5a93",
     "README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
     "data/atlas-ttps.json": "c36c0a27c8de8a37a7070923d7b187345c46db9db778f58e4637f1f81ca6d6b1",
-    "data/attack-techniques.json": "c2dcbd311fc5280b32e87e7705f5db5f1a5da7a97ac72bd33defa025b5d2c55a",
-    "data/cve-catalog.json": "387f78d2ba3b5961f9e7276ed06cc394f0df8edc8c32c427ac1fc46ce124b895",
-    "data/cwe-catalog.json": "b833d102be2a2485c7c275edcb8140813343fb289d7d9fd352c12ffb016e1bf2",
+    "data/attack-techniques.json": "f004eadd708c9243aea6667e683451b29921b6cec45d1aec9bf63b4b49493b13",
+    "data/cve-catalog.json": "deddba50e7f8d16528b04007715a1574211d058afc403d36c475ca8380e89eec",
+    "data/cwe-catalog.json": "4a11ae07ebfb69c9f7321a51468d36335cfa42f7c049d24439e39ed99fda18d8",
     "data/d3fend-catalog.json": "feec37e4b0a40cd7bc14616b50e7b9bcdb58a92d8e9326f9e2e632896d8ea576",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
     "data/exploit-availability.json": "37300ecbfcb00a4a31423d280247a89a851b1145b5c4200a5513429bfd07dd9b",
-    "data/framework-control-gaps.json": "928fe789dab5f9fafcb2f9e7f82e72e5f0e6b94c9781a460338279fb7ff831ce",
+    "data/framework-control-gaps.json": "8ddc65d007fd67c9f6ef3a9f818b09e8025af72d59532a4785bdba956dd01dfd",
     "data/global-frameworks.json": "86249047c50d2584b4854eb381ba53c309c0e6e29d4cb0e522b4ba1405481de6",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "ac80c712f24408667da61433eff002922f3c056b8fb8d9927442814d9fe1c599",
+    "data/zeroday-lessons.json": "a8fec7dd4cc7fd2b817d593c07e697b94f32628d9b197a4d7d3d9bafda7754a4",
     "skills/kernel-lpe-triage/skill.md": "78a547771c42b9348a1f80201e0f1b8a5ed3e7b4f15b35b1f64cf4ee54b0480b",
     "skills/ai-attack-surface/skill.md": "bc9084127e4e928cba439187025f9e77aaca8089fe64891312824e74dd9fdb5b",
     "skills/mcp-agent-trust/skill.md": "c20bda4c1267b16db4f713667216d93e0ab4b98c0fb244024749dcfb32d709cf",
@@ -101,7 +101,7 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 1739,
+    "chains_cve_entries": 1741,
     "chains_cwe_entries": 241,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,

package/data/_indexes/activity-feed.json

@@ -6,20 +6,20 @@
   },
   "events": [
     {
-      "date": "2026-09-24",
+      "date": "2026-09-27",
       "type": "catalog_update",
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 1752
+      "entry_count": 1754
     },
     {
-      "date": "2026-09-24",
+      "date": "2026-09-27",
       "type": "catalog_update",
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 1752
+      "entry_count": 1754
     },
     {
       "date": "2026-09-22",

package/data/_indexes/catalog-summaries.json

@@ -53,7 +53,7 @@
       "path": "data/cve-catalog.json",
       "purpose": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-09-24",
+      "last_updated": "2026-09-27",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -62,13 +62,13 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1752,
+      "entry_count": 1754,
       "sample_keys": [
+        "CVE-2021-20021",
+        "CVE-2021-20016",
         "CVE-2026-93952",
         "CVE-2021-31207",
-        "CVE-2021-34473",
-        "CVE-2020-1380",
-        "CVE-2021-27085"
+        "CVE-2021-34473"
       ]
     },
     "cwe-catalog.json": {
@@ -229,7 +229,7 @@
       "path": "data/zeroday-lessons.json",
       "purpose": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
       "schema_version": "1.1.0",
-      "last_updated": "2026-09-24",
+      "last_updated": "2026-09-27",
       "tlp": "CLEAR",
       "source_confidence_default": "B2",
       "freshness_policy": {
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1752,
+      "entry_count": 1754,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",

package/data/_indexes/chains.json

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/data/_indexes/chains.json
-size: 36311254 bytes
-sha256: 366466a666605d85809fe074e7a86c98dce01672b3b6e494aff219df50b168a0
+size: 36349248 bytes
+sha256: aa2128b2d2b717ec78e2dd26148720fb46f398583a8971780939aafb00ca09ea

package/data/attack-techniques.json

@@ -1213,6 +1213,8 @@
       "CVE-2020-5735",
       "CVE-2020-8816",
       "CVE-2020-9377",
+      "CVE-2021-20016",
+      "CVE-2021-20021",
       "CVE-2021-20035",
       "CVE-2021-21975",
       "CVE-2021-25296",
@@ -1999,6 +2001,8 @@
       "CVE-2020-9377",
       "CVE-2021-1497",
       "CVE-2021-1498",
+      "CVE-2021-20016",
+      "CVE-2021-20021",
       "CVE-2021-20028",
       "CVE-2021-20035",
       "CVE-2021-20038",
@@ -3199,6 +3203,7 @@
       "CVE-2019-5591",
       "CVE-2020-4427",
       "CVE-2020-8193",
+      "CVE-2021-20016",
       "CVE-2021-22986",
       "CVE-2023-23397",
       "CVE-2023-43791",
@@ -6903,6 +6908,7 @@
     "cve_refs": [
       "CVE-2014-100005",
       "CVE-2018-19410",
+      "CVE-2021-20021",
       "CVE-2021-22205",
       "CVE-2021-35587",
       "CVE-2022-23227",

package/data/cve-catalog.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "schema_version": "1.0.0",
-    "last_updated": "2026-09-24",
+    "last_updated": "2026-09-27",
     "source": "NVD + CISA KEV + vendor advisories — see sources/index.json",
     "required_fields": [
       "type",
@@ -93,6 +93,223 @@
     },
     "last_threat_review": "2026-05-30"
   },
+  "CVE-2021-20021": {
+    "name": "SonicWall Email Security Improper Privilege Management Vulnerability",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-269"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2021-11-17",
+    "known_ransomware_use": true,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.",
+    "epss_score": 0.8867,
+    "epss_percentile": 0.99772,
+    "epss_date": "2026-09-26",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-20021",
+    "vendor_advisories": [
+      {
+        "vendor": "SonicWall",
+        "advisory_id": "SNWLID-2021-0007",
+        "url": "https://psirtapi.global.sonicwall.com/api/v1/vulndetail/?advisory_id=SNWLID-2021-0007",
+        "severity": "critical",
+        "published_date": "2021-04-09"
+      },
+      {
+        "vendor": "SonicWall",
+        "advisory_id": "Security Notice: SonicWall Email Security Zero-Day Vulnerabilities",
+        "url": "https://www.sonicwall.com/support/product-notification/security-notice-sonicwall-email-security-zero-day-vulnerabilities/kA1VN0000000Qyr0AE",
+        "severity": "unknown",
+        "published_date": "2021-04-16"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-20021",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0007"
+    ],
+    "source_verified": "2026-09-27",
+    "last_updated": "2026-09-27",
+    "_kev_short_description": "SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.",
+    "type": "auth-bypass-admin-account-creation",
+    "blast_radius": 18,
+    "poc_available": false,
+    "poc_description": "No working exploit code is published at a nameable location. Mandiant documented the request format, an unauthenticated GET or POST to the /createou endpoint carrying an XML document that creates a role.ouadmin administrative account, but published no exploit code. The GitHub repository SUPRAAA-1337/CVE-2021-20021, the one repository the PoC-in-GitHub index lists for this CVE, holds a single template that sends GET /createou?data=123 and matches the response text 'Error in parsing request'; it probes whether the endpoint parses an unauthenticated request and does not create an account, and only its request path and response matcher were read. The only ProjectDiscovery template, http/cves/2021/CVE-2021-20021.yaml, is a passive version check that fetches /login.html and confirms an Email Security Login page at or below 10.0.9, not a working exploit. No Exploit-DB entry or Metasploit module for this flaw was found.",
+    "iocs": {
+      "behavioral": [
+        "Creation of a new SonicWall Email Security administrator account (a role.ouadmin account) that no operator initiated."
+      ],
+      "network": [
+        "An unauthenticated GET or POST to a path ending in /createou, whatever the data parameter holds: a data value carrying an XML document marks an attempt to create an account, and a non-XML value such as data=123 marks a probe of the endpoint.",
+        "Authentication to the Email Security administrative panel by an ouadmin account that was created without an operator action."
+      ],
+      "host": [
+        "A SonicWall Email Security instance running a build before 10.0.9.6103 (Windows software or Hosted Email Security) or before 10.0.9.6105 (hardware or virtual appliance), or any end-of-life 7.0.0 through 9.2.2 release.",
+        "On a Windows installation, an administrator entry in data\\multi_accounts.xml under the SonicWallES installation directory, or a new account file under its data\\perhost, data\\perldap or data\\perou directories, that no operator created.",
+        "Requests to /createou recorded in the Apache Tomcat logs under Apache Software Foundation\\Tomcat 9.0\\logs in the SonicWallES installation directory, or in the application log logs\\webUI\\webui.json in that directory."
+      ],
+      "_ioc_source_note": "The unauthenticated /createou endpoint, the XML data document and the created role.ouadmin account come from the Mandiant analysis at https://cloud.google.com/blog/topics/threat-intelligence/zero-day-exploits-in-sonicwall-email-security-lead-to-compromise/, as do the account files (multi_accounts.xml and the perhost, perldap and perou directories) and the Tomcat and webui.json log locations that Mandiant lists for review on a Windows installation. Mandiant lists these files under C:\\Program Files\\SonicWallES, while the log-clearing command it recorded on the compromised host wrote to C:/Program Files (x86)/SonicWallES/logs/webUI/webui.json, so the host paths are given relative to the SonicWallES installation directory. The /createou indicator matches both GET and POST because Mandiant records that the endpoint accepted either, and matches any data value because the GitHub template SUPRAAA-1337/CVE-2021-20021 at https://raw.githubusercontent.com/SUPRAAA-1337/CVE-2021-20021/main/CVE-2021-20021.yaml probes the endpoint with data=123; only that template's request path and response matcher were read. The version boundaries come from the NVD record and SonicWall advisory SNWLID-2021-0007 at https://psirtapi.global.sonicwall.com/api/v1/vulndetail/?advisory_id=SNWLID-2021-0007, and the end-of-life 7.0.0 through 9.2.2 releases from the SonicWall notice at https://www.sonicwall.com/support/product-notification/security-notice-sonicwall-email-security-zero-day-vulnerabilities/kA1VN0000000Qyr0AE. Mandiant also reports activity from the other two flaws in the chain, which is not listed as an indicator of this one: the Apache Tomcat process spawning cmd.exe and the emptying of webui.json both ran through the web shell planted with CVE-2021-20022, the reading of multi_accounts.xml and multi_ldap.xml went through CVE-2021-20023, Mandiant lists the exposure of hashed administrator passwords as a result of the three flaws combined, and requests to the branding feature belong to CVE-2021-20022 and CVE-2021-20023. Where webui.json has been emptied, the Tomcat logs are the remaining record of /createou requests. The passive version-detection artifacts (a GET to /login.html, the Email Security Login page and an Apache-Coyote header) come from the ProjectDiscovery template at https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2021/CVE-2021-20021.yaml. No specific actor infrastructure, file hash or command-and-control address is listed: Mandiant tracked the activity as UNC2682 but did not publish actor indicators for this flaw, and while the KEV record marks known ransomware use as Known, the Mandiant report names no ransomware family for this chain."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Mandiant identified the flaw in March 2021 after detecting web shell activity on a customer system, and SonicWall advisory SNWLID-2021-0007 credits Josh Fleischer and Chris DiGiamo of Mandiant, an outside firm. No source claims AI tooling was used.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2021-20021 (CWE-269, CVSS 9.8) + CISA KEV (added 2021-11-03, ransomware: Known) + SonicWall advisory SNWLID-2021-0007 at https://psirtapi.global.sonicwall.com/api/v1/vulndetail/?advisory_id=SNWLID-2021-0007, which credits Josh Fleischer and Chris DiGiamo of Mandiant, who reported the flaw after detecting its in-the-wild use.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2021-20021 to its Known Exploited Vulnerabilities catalog on 2021-11-03 with a 2021-11-17 due date and records known ransomware use as Known. Mandiant documented one compromise, found in March 2021 on an internet-accessible SonicWall Email Security installation running on Windows Server 2012, and tracks the activity as UNC2682. The attacker used this flaw with CVE-2021-20022 and CVE-2021-20023 to create an administrator account, plant a web shell and read files, then dumped credentials, compressed a directory of email archives and moved laterally with Impacket's WMIEXEC. SonicWall states that the flaws were exploited in at least one known case. The KEV record marks forensic triage as No, so BOD 26-04 forensic-triage handling is not required for this entry.",
+    "attack_refs": [
+      "T1190",
+      "T1136",
+      "T1078"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-AC-3": "AC-3 requires the system to enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. On Email Security builds before 10.0.9.6103 (Windows software and Hosted Email Security) and 10.0.9.6105 (appliances), the /createou form that creates a role.ouadmin administrator account processed a GET or POST without prior authentication, and an organization running the product cannot place its own AC-3 enforcement inside that vendor form, so the authorizations it had approved for administrator accounts did not govern the account the request created.",
+      "NIS2-Art21-network-security": "NIS2 Article 21(2)(a) requires policies on risk analysis and information system security, and Article 21(2)(e) requires security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure, without setting a timeframe. Mandiant found this flaw exploited in March 2021, before SonicWall published the hotfix on April 9, 2021, so vulnerability handling had no vendor fix to apply during that period. For entities within Implementing Regulation (EU) 2024/2690, point 6.6.1 requires additional measures where a patch is not available, and points 6.7.2(c), (d) and (f) and 6.8.2(f) and (g) require controls that prevent access not required for operation, control remote access, deactivate unneeded connections and separate the administration network and its channels; meeting them would have kept the Email Security administration interface, which Mandiant notes the product does not require to be exposed, off the internet, where scanning cited by Mandiant found about 700 publicly reachable interfaces. For entities outside that regulation, Article 21(2)(e) names no interim measure for the period between exploitation in March 2021 and the April 9, 2021 hotfix.",
+      "UK-CAF-B2": "CAF principle B2.a requires that access to the systems supporting an essential function is verified, authenticated and authorized for users, devices and systems, and that all remote access is individually authenticated and authorized. The /createou form ran before any authentication, so the remote request that created the role.ouadmin account was never individually authenticated. The attacker then logged in with that account, and a B2 privileged-account review finds it in multi_accounts.xml or the perou account files only after the access has happened.",
+      "AU-ISM-1546": "ISM-1546 requires that users are authenticated before they are granted access to a system and its resources. On Email Security builds before 10.0.9.6103 (Windows software and Hosted Email Security) and 10.0.9.6105 (appliances), the /createou form accepted a GET or POST without prior authentication and created a role.ouadmin administrator account, and the victim Mandiant investigated was running the latest 10.0.9 build available for download, so the authentication the organization had configured on the administration interface did not apply to that form until SonicWall shipped the April 9, 2021 hotfix.",
+      "ISO-27001-2022-A.5.15": "A.5.15 requires rules to control physical and logical access to information and other associated assets to be established and implemented based on business and information security requirements. An organization could have rules in place that limit who administers Email Security, yet on builds before 10.0.9.6103 and 10.0.9.6105 an unauthenticated request to /createou created a role.ouadmin account that the attacker then used to log in as an administrator, so the rules did not apply to an account the product created on an outside request."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "Fixed builds exist for the supported 10.0.x line: Hotfix 10.0.9.6103 for Email Security on Windows and for Hosted Email Security, and Hotfix 10.0.9.6105 for hardware and ESXi virtual appliances, close this flaw. 10.0.9.6173 (Windows and Hosted Email Security, which SonicWall patched on April 19, 2021) and 10.0.9.6177 (hardware and ESXi virtual appliance) close the exploited chain with CVE-2021-20022 and CVE-2021-20023. Email Security 7.0.0 through 9.2.2 is also affected, is end of life and unsupported, and has no fix in that line. No live-patch path is documented. SonicWall's upgrade article, which its security notice names as the guidance for applying these updates, says the appliance reboots once the update is done and that mail flow stops during the update, so about 30 minutes of downtime should be scheduled. No source states whether installing the update on the Windows software reboots the server.",
+    "affected": "SonicWall Email Security, on-premises (software for Windows, hardware appliances and the virtual appliance) and Hosted (HES): builds before 10.0.9.6103 (Windows software and HES) and before 10.0.9.6105 (appliances), and the end-of-life 7.0.0 through 9.2.2 releases. An unauthenticated attacker sends a crafted request to an administrative endpoint that does not verify prior authentication, creating an administrative account and gaining administrative access to the product.",
+    "affected_versions": [
+      "SonicWall Email Security software for Windows and Hosted Email Security, builds before 10.0.9.6103 (fixed in Hotfix 10.0.9.6103; Hosted Email Security was updated automatically). The exploited chain with CVE-2021-20022 and CVE-2021-20023 stays open before 10.0.9.6173.",
+      "SonicWall Email Security hardware appliances (models 3300, 4300, 5000, 5050, 7000, 7050, 8300 and 9000 in the NVD record) and the virtual appliance, builds before 10.0.9.6105 (fixed in Hotfix 10.0.9.6105). The exploited chain stays open before 10.0.9.6177.",
+      "SonicWall Email Security 7.0.0 through 9.2.2, which is end of life, is unsupported and has no fix in that line."
+    ],
+    "vendor_update_paths": [
+      "Upgrade on-premises SonicWall Email Security for Windows to Hotfix 10.0.9.6103, and hardware or ESXi virtual appliance installations to Hotfix 10.0.9.6105, from MySonicWall; these builds close CVE-2021-20021. To close the exploited chain with CVE-2021-20022 and CVE-2021-20023, install 10.0.9.6173 (Windows software) or 10.0.9.6177 (hardware and ESXi virtual appliance), released on April 19, 2021.",
+      "Hosted Email Security is updated automatically by SonicWall, to 10.0.9.6103 for this flaw and to 10.0.9.6173 on April 19, 2021 for the full chain, and no customer action is required.",
+      "Email Security 7.0.0 through 9.2.2 is end of life and receives no fix in that line. Organizations with an active support license can download the latest Email Security release from MySonicWall and upgrade to a build at or above 10.0.9.6173 (Windows) or 10.0.9.6177 (appliance); without one, renew the license through a SonicWall partner before upgrading, or replace the product. When upgrading from 10.0.1 through 10.0.3 or from an end-of-life release, follow SonicWall's upgrade path without skipping any intermediate firmware version, as its upgrade article cautions.",
+      "Because this flaw is chained with CVE-2021-20022 and CVE-2021-20023 to reach code execution, treat any exposed instance as potentially compromised: check for unexpected administrator accounts and web shells and rotate credentials before or alongside applying the hotfix."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 53,
+    "rwep_notes": "RWEP 53. cisa_kev +25, active_exploitation +20, blast_radius +18, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
+  "CVE-2021-20016": {
+    "name": "SonicWall SSLVPN SMA100 SQL Injection Vulnerability",
+    "cvss_score": 9.8,
+    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+    "cwe_refs": [
+      "CWE-89"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2021-11-03",
+    "cisa_kev_due_date": "2021-11-17",
+    "known_ransomware_use": true,
+    "active_exploitation": "confirmed",
+    "complexity": "low",
+    "vector": "A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.",
+    "epss_score": 0.40038,
+    "epss_percentile": 0.98585,
+    "epss_date": "2026-09-26",
+    "epss_source": "https://api.first.org/data/v1/epss?cve=CVE-2021-20016",
+    "vendor_advisories": [
+      {
+        "vendor": "SonicWall",
+        "advisory_id": "SNWLID-2021-0001",
+        "url": "https://psirtapi.global.sonicwall.com/api/v1/vulndetail/?advisory_id=SNWLID-2021-0001",
+        "severity": "critical",
+        "published_date": "2021-01-23"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2021-20016",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001"
+    ],
+    "source_verified": "2026-09-27",
+    "last_updated": "2026-09-27",
+    "_kev_short_description": "SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.",
+    "type": "sql-injection-credential-access",
+    "blast_radius": 18,
+    "poc_available": false,
+    "poc_description": "No hosted working exploit was found for CVE-2021-20016: there is no Metasploit module, no ProjectDiscovery nuclei template and no Exploit-DB entry, and a GitHub search returned no exploit repository. Mandiant and SonicWall describe the flaw as an unauthenticated SQL injection returning credentials but publish no runnable proof of concept.",
+    "iocs": {
+      "behavioral": [
+        "Use of SMA 100 account credentials or session tokens from a source that did not perform the interactive login, consistent with credential theft through the SQL injection",
+        "Successful web-interface logins to an SMA 100 appliance following the disclosure window using credentials that were valid before password resets were performed"
+      ],
+      "network": [
+        "Unauthenticated HTTP requests to the SMA 100 series web interface that carry SQL-injection syntax and return username, password or session information, against SMA 200, SMA 210, SMA 400, SMA 410 or the SMA 500v virtual appliance on 10.x firmware",
+        "Access to the SMA 100 management or Virtual Office interface from untrusted internet sources on an appliance still running 10.x below 10.2.0.5-29sv",
+        "Requests from external sources to /cgi-bin/management whose Referer does not contain /__api__/v1/logon, or to /cgi-bin/sslvpnclient or /cgi-bin/portal whose Referer contains neither /__api__/v1/logon nor /cgi-bin/userLogin, as matched by Emerging Threats Open rules 2033345, 2033346 and 2033347 for CVE-2021-20016. These rules match use of a session that did not come through the login pages, as when a session read through the injection is reused, and do not match the injection request itself"
+      ],
+      "host": [
+        "SMA 100 series appliance (SMA 200, SMA 210, SMA 400, SMA 410 or SMA 500v) running 10.x firmware below 10.2.0.5-29sv"
+      ],
+      "_ioc_source_note": "The affected product lines, the firmware boundary, the built-in WAF and MFA guidance and the credential-exposure impact were read from SonicWall's product notification (archived at http://web.archive.org/web/20210219205404/https://www.sonicwall.com/support/product-notification/additional-sma-100-series-10-x-and-9-x-firmware-updates-required-updated-feb-19-2-p-m-cst/210122173415410/), and the pre-patch, in-the-wild exploitation and its attribution to UNC2447 from Mandiant's report at https://cloud.google.com/blog/topics/threat-intelligence/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat. The /cgi-bin/management, /cgi-bin/sslvpnclient and /cgi-bin/portal Referer conditions were read from Emerging Threats Open rules 2033345, 2033346 and 2033347 at https://rules.emergingthreats.net/open/suricata-5.0/rules/emerging-exploit.rules, which ET labels as potential SMA authentication bypass for CVE-2021-20016; they detect reuse of a session outside the login flow after the injection, not the injection request. Every other behavioral and network item is a general hunting heuristic drawn from the flaw's described effect (credential and session theft through an unauthenticated SQL injection), not an artifact read from a source. SonicWall wrote that it was 'not aware of any forensic data that can be viewed by the user to determine whether a device has been attacked', so the host indicator is the firmware level rather than a vendor-supplied artifact. No file hash or C2 address specific to CVE-2021-20016 is listed, because neither SonicWall's notice nor Mandiant's report ties one to this flaw; the FIVEHANDS and SOMBRAT indicators in Mandiant's report cover later intrusion stages, not this flaw."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Reported to SonicWall by the NCC Group on January 31 and February 2, 2021, tracked under SonicWall PSIRT advisory SNWLID-2021-0001. No AI tooling is claimed by any source.",
+    "ai_discovery_source": "human_researcher",
+    "discovery_attribution_note": "Sourced from NVD CVE-2021-20016 (CWE-89, CVSS 9.8) + CISA KEV (added 2021-11-03, ransomware: Known) + SonicWall advisory SNWLID-2021-0001, with pre-patch exploitation attributed to UNC2447 (FIVEHANDS) in Mandiant's April 29, 2021 report and the fixed firmware taken from SonicWall's product notification.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2021-20016 to KEV on 2021-11-03 with a 2021-11-17 due date and records known ransomware use. Mandiant observed UNC2447 exploiting this SMA 100 SQL injection prior to a patch being available and forensically linked the group to FIVEHANDS ransomware; Mandiant has observed evidence of UNC2447 affiliated actors previously using RAGNARLOCKER, suspects that HELLOKITTY may have been used by an overall affiliate program, and has observed the group targeting organizations in Europe and North America. SonicWall's January 22, 2021 notice reported a coordinated attack on its internal systems by threat actors exploiting probable zero-day vulnerabilities on certain of its secure remote access products, and named SMA 100 series 10.x and the NetExtender 10.x client as the impacted products; its January 23 update ruled out NetExtender. SonicWall published SNWLID-2021-0001 on January 23 and on February 1 updated it to a confirmed zero-day in SMA 100 build version 10.x, the flaw tracked as CVE-2021-20016, but it did not state explicitly that this flaw was the one used against its internal systems. The KEV record's forensicTriage flag is No.",
+    "attack_refs": [
+      "T1190",
+      "T1212",
+      "T1078"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires flaws to be identified, reported and corrected, and security-relevant updates installed within an organization-defined time period of their release. SonicWall released 10.2.0.5-29sv on February 3, 2021, three days after the NCC Group's January 31 report, but it had been publishing interim measures for SMA 100 series 10.x before then (access restrictions and MFA from January 22, password resets from February 1 and the built-in WAF on February 2), and UNC2447 exploited the flaw before the update existed. SI-2 measures its period from an update's release and does not cover applying a vendor's interim measures before one exists.",
+      "NIS2-Art21-patch-management": "NIS2 Article 21(2)(e) requires vulnerability handling and sets no timeframe. For entities within Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires security patches to be applied within a reasonable time after they become available and, where a patch is not available, additional measures with the residual risk accepted. SonicWall's fix for CVE-2021-20016, 10.2.0.5-29sv, shipped on February 3, 2021, the day after it published the built-in WAF as a mitigation, so the additional-measures clause governed the period from its January 22 notice to February 3. Annex point 6.6.1 does not name the measures, and SonicWall's own guidance in that period ranged from access restrictions and MFA to the WAF and shutting the appliance down.",
+      "UK-CAF-B4": "CAF principle B4.d asks that externally exposed vulnerabilities are mitigated promptly, for example by patching, and that temporary mitigations are in place for unsupported systems and software. The SMA 100 is the remote-access entry point itself, and this unauthenticated SQL injection returns usernames, passwords and session data, so the outcome can be met by a mitigation that leaves stolen material usable. The built-in WAF and the 10.2.0.5-29sv firmware stop further reads and MFA limits reuse of stolen passwords, but none of them changes passwords read before it was applied, and B4.d does not name the password reset SonicWall directs after patching.",
+      "AU-Essential-8-Patch": "The Essential Eight requires, at every maturity level, that patches, updates or other vendor mitigations for the operating systems of internet-facing network devices are applied within 48 hours of release when the vendor rates the flaw critical or a working exploit exists (ISM-1877), and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1694); the SMA 100 series is an internet-facing network device, and SonicWall rated this flaw a critical zero-day. The window opened with SonicWall's first mitigations for SMA 100 series 10.x on January 22 and 23, 2021: allow SSL-VPN connections only from known IP addresses, or disable Virtual Office and HTTPS administrative access from the internet, and enable MFA on all SMA accounts. The access restrictions reduced who could send the request and MFA limits reuse of stolen passwords, but neither removed the SQL injection, which the built-in WAF (February 2) was observed to neutralize and 10.2.0.5-29sv (February 3) fixed. Applying those steps within 48 hours does not change credentials already read. The password reset SonicWall lists among its mitigations does, and the window covers it as a vendor mitigation, but no ISM patch control requires an assessment of whether the appliance was exploited before the mitigations were applied, and SonicWall stated that it was not aware of any forensic data a user could view to determine whether a device had been attacked.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires that information about technical vulnerabilities of systems in use is obtained, the organization's exposure is evaluated and appropriate measures are taken, and it sets no time by which the measures must be in place. For CVE-2021-20016 SonicWall's measures arrived over the 12 days from its January 22, 2021 notice to the 10.2.0.5-29sv firmware on February 3, and A.8.8 does not say how quickly an organization must apply each one to an internet-facing remote-access appliance that UNC2447 was exploiting before the fix."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "Remediation is a firmware upgrade on the SMA 100 series 10.x line to 10.2.0.6-32sv, which SonicWall released on February 19, 2021 with the CVE-2021-20016 fix first shipped in 10.2.0.5-29sv (February 3, 2021) plus code-hardening fixes; SonicWall directs devices already on 10.2.0.5-29sv to upgrade to 10.2.0.6-32sv as well. SonicWall published a built-in Web Application Firewall configuration as an interim mitigation but stated it does not replace the firmware. No reload-free path for the fix is documented: SonicWall's SMA 100 firmware upgrade article has the administrator upload the firmware and click Boot, and the device then reboots.",
+    "affected": "SonicWall Secure Mobile Access SMA 100 series remote-access appliances (SMA 200, SMA 210, SMA 400, SMA 410 and the SMA 500v virtual appliance) running 10.x firmware before 10.2.0.5-29sv. An unauthenticated attacker who can send requests to the SSL VPN web interface reads usernames, passwords and session information through SQL injection, which enables login to the appliance. SMA 100 firmware prior to 10.x is not affected.",
+    "affected_versions": [
+      "SMA 100 series firmware from 10.0.0.0 up to builds before 10.2.0.5-d-29sv are affected (NVD boundary)",
+      "First fixed on the 10.x line in 10.2.0.5-29sv (February 3, 2021); SonicWall's February 19, 2021 release 10.2.0.6-32sv includes that fix plus code-hardening fixes, and SonicWall directs 10.x devices, including those already on 10.2.0.5-29sv, to upgrade to 10.2.0.6-32sv",
+      "SMA 100 firmware prior to 10.x is not affected"
+    ],
+    "vendor_update_paths": [
+      "Upgrade SMA 100 series 10.x appliances to 10.2.0.6-32sv, SonicWall's February 19, 2021 release, which includes the CVE-2021-20016 fix first shipped in 10.2.0.5-29sv plus code-hardening fixes; SonicWall directs devices already on 10.2.0.5-29sv to upgrade to 10.2.0.6-32sv as well, and the firmware is available regardless of support-contract status. After upgrading, reset the passwords of any users who may have logged in to the device through the web interface and enable multifactor authentication; SonicWall states the reset after 10.2.0.6-32sv applies only if the device did not deploy 10.2.0.5-29sv.",
+      "SonicWall's February 19, 2021 notice also directs SMA 100 series 9.x customers to 9.0.0.10-28sv, a separate code-hardening release; 9.x firmware is not affected by CVE-2021-20016.",
+      "Where the firmware cannot be installed immediately, enable the built-in Web Application Firewall on 10.x devices and enable multifactor authentication as interim mitigations; SonicWall states the WAF does not replace the need to apply the patch.",
+      "If no fix or mitigation can be applied, block the SMA 100 at the firewall or shut it down until it is patched."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 18,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 53,
+    "rwep_notes": "RWEP 53. cisa_kev +25, active_exploitation +20, blast_radius +18, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
   "CVE-2026-93952": {
     "name": "Arista VeloCloud Orchestrator Improper Input Validation Vulnerability",
     "cvss_score": 9.5,

package/data/cwe-catalog.json

@@ -662,6 +662,7 @@
       "CVE-2020-17463",
       "CVE-2020-29574",
       "CVE-2020-5722",
+      "CVE-2021-20016",
       "CVE-2021-20028",
       "CVE-2021-27101",
       "CVE-2021-42258",
@@ -1095,6 +1096,7 @@
       "CVE-2019-3010",
       "CVE-2020-1938",
       "CVE-2020-8655",
+      "CVE-2021-20021",
       "CVE-2021-23874",
       "CVE-2021-25337",
       "CVE-2021-31199",

package/data/framework-control-gaps.json

@@ -1226,6 +1226,7 @@
       "CVE-2021-1870",
       "CVE-2021-1871",
       "CVE-2021-1879",
+      "CVE-2021-20016",
       "CVE-2021-20028",
       "CVE-2021-20035",
       "CVE-2021-20038",
@@ -3882,6 +3883,7 @@
       "CVE-2021-1870",
       "CVE-2021-1871",
       "CVE-2021-1879",
+      "CVE-2021-20016",
       "CVE-2021-20028",
       "CVE-2021-20035",
       "CVE-2021-20090",
@@ -5263,6 +5265,7 @@
       "CVE-2021-1789",
       "CVE-2021-1871",
       "CVE-2021-1879",
+      "CVE-2021-20016",
       "CVE-2021-20028",
       "CVE-2021-21148",
       "CVE-2021-21193",
@@ -7272,6 +7275,7 @@
       "CVE-2021-1870",
       "CVE-2021-1871",
       "CVE-2021-1879",
+      "CVE-2021-20016",
       "CVE-2021-20028",
       "CVE-2021-20035",
       "CVE-2021-20090",
@@ -9371,6 +9375,7 @@
       "CVE-2020-8816",
       "CVE-2020-9934",
       "CVE-2021-1871",
+      "CVE-2021-20021",
       "CVE-2021-20124",
       "CVE-2021-22506",
       "CVE-2021-22681",
@@ -11481,6 +11486,7 @@
       "CVE-2020-8193",
       "CVE-2020-8644",
       "CVE-2020-9934",
+      "CVE-2021-20021",
       "CVE-2021-20090",
       "CVE-2021-25337",
       "CVE-2021-26085",
@@ -12792,6 +12798,7 @@
       "CVE-2021-1789",
       "CVE-2021-1870",
       "CVE-2021-1879",
+      "CVE-2021-20016",
       "CVE-2021-20028",
       "CVE-2021-20035",
       "CVE-2021-20090",
@@ -13685,6 +13692,7 @@
       "CVE-2020-2021",
       "CVE-2020-2555",
       "CVE-2020-8644",
+      "CVE-2021-20021",
       "CVE-2021-33044",
       "CVE-2021-33045",
       "CVE-2021-34473",
@@ -14019,6 +14027,7 @@
       "CVE-2020-14882",
       "CVE-2020-2506",
       "CVE-2020-8644",
+      "CVE-2021-20021",
       "CVE-2021-22506",
       "CVE-2021-25337",
       "CVE-2021-27876",
@@ -14448,6 +14457,7 @@
       "CVE-2020-8193",
       "CVE-2020-8195",
       "CVE-2020-8196",
+      "CVE-2021-20021",
       "CVE-2021-20035",
       "CVE-2021-20123",
       "CVE-2021-20124",