VulnRadar

Data against noise.

Built with NaN
Page generated: 09 Nov 2026, 09:59 UTC
← Dashboard

CVE-2021-20028

Wazawaka

Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier

CVSS 9.8 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.6/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.8: +1.47
  • Fresh EPSS: 30.08%: +0.15

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 23 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

CyberSecurityNews
Press · 02 Mar 2026, 08:00 · Hackers Attacking SonicWall Firewalls from 4,000+ unique IP Addresses to Exploit Vulnerabilities - CyberSecurityNews
GreyNoise
Press · 27 Feb 2026, 08:00 · Active Reconnaissance Campaign Targets SonicWall Firewalls Through Commercial Proxy Infrastructure - GreyNoise
Cybersecurity Dive
Press · 28 Jan 2025, 08:00 · SonicWall SMA 1000 series appliances left exposed on the internet - Cybersecurity Dive
Krebs on Security
Press · 04 Dec 2024, 08:00 · U.S. Offered $10M for Hacker Just Arrested by Russia - Krebs on Security
The Record from Recorded Future News
Press · 02 Dec 2024, 08:00 · Ransomware suspect Wazawaka reportedly arrested by Russia - The Record from Recorded Future News
See all 23 source documents
CyberScoop
Press · 02 Dec 2024, 08:00 · Notorious ransomware developer charged with computer crimes in Russia - CyberScoop
Engadget
Press · 29 Nov 2024, 08:00 · Russia arrests ransomware attacker Wazawaka - Engadget
The Hacker News
Press · 19 Dec 2023, 08:00 · Behind the Scenes of Matveev's Ransomware Empire: Tactics and Team - The Hacker News
Tech Times
Press · 03 Oct 2023, 07:00 · FBI Most Wanted Russian Hacker ‘Wazawaka’ Unfazed by US Sanctions, Claims ‘Better’ Life - Tech Times
Firstpost
Press · 19 Sep 2023, 07:00 · 'Most Wanted' Russian hacker 'Wazawaka' trolls US govt, FBI - Firstpost
The Hacker News
Press · 17 May 2023, 07:00 · U.S. Offers $10 Million Bounty for Capture of Notorious Russian Ransomware Operator - The Hacker News
Bitdefender
Press · 17 May 2023, 07:00 · US Department of Justice Offers $10 Million Bounty for Alleged Russian Ransomware Mastermind - Bitdefender
Krebs on Security
Press · 16 May 2023, 07:00 · Russian Hacker “Wazawaka” Indicted for Ransomware - Krebs on Security
The Record from Recorded Future News
Press · 16 May 2023, 07:00 · Alleged Babuk ransomware gang leader ‘Wazawaka’ indicted, sanctioned by US - The Record from Recorded Future News
BankInfoSecurity
Press · 16 May 2023, 07:00 · Alleged Babuk Ransomware 'Wazawaka' Hacker Indicted in US - BankInfoSecurity
The Washington Post
Press · 16 May 2023, 07:00 · U.S. charges Russian in global ransomware attacks, including on D.C. - The Washington Post
Bloomberg.com
Press · 16 May 2023, 07:00 · Alleged Russian Hacker Charged in $200 Million Ransomware Spree - Bloomberg.com
Security Affairs
Press · 14 Mar 2023, 07:00 · Dissecting the malicious arsenal of the Makop ransomware gang - Security Affairs
The Record from Recorded Future News
Press · 25 Aug 2022, 07:00 · An interview with initial access broker Wazawaka: 'There is no such money anywhere as there is in ransomware' - The Record from Recorded Future News
Krebs on Security
Press · 14 Feb 2022, 08:00 · Wazawaka Goes Waka Waka - Krebs on Security
Krebs on Security
Press · 14 Feb 2022, 08:00 · Mikhail Pavlovich Matveev - Krebs on Security
Krebs on Security
Press · 12 Jan 2022, 08:00 · Who is the Network Access Broker ‘Wazawaka?’ - Krebs on Security
CrowdStrike
Press · 08 Jun 2021, 07:00 · How eCrime Groups Leverage an Old SonicWall Vulnerability - CrowdStrike

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.6 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.8; EPSS 30.1%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:58:22.744333+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
08 Jun 2021, 07:00
Published
04 Aug 2021, 19:10
Added to the CISA KEV catalog
28 Mar 2022, 00:00
Latest press mention
02 Mar 2026, 08:00
Score calculated
05 Nov 2026, 13:58
Name
Wazawaka
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar