Email Security and management
CVE-2021-20025: SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username a…
SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at initial setup.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Email Security Virtual Appliance 10.0 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at initial setup. An attacker could exploit this transitional/temporary user account from the trusted domain to access the Virtual Appliance remotely only when the device is freshly installed and not connected to Mysonicwall.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.