SonicWall Email Security Unauthenticated Arbitrary User Creation (CVE-2021-20021)

Tim Peck@timpeck

•updated Nov 11, 2025•1•29

This rule detects attempts to exploit CVE-2021-20021, an unauthenticated arbitrary user creation vulnerability in SonicWall Email Security. The detection is based on HTTP GET requests to the '/createou' URI containing 'data=' in the request body, which is indicative of an exploitation attempt.