CVE-2019-7481highunder attackransomwareCWE-89

CVE-2019-7481: high-severity vulnerability in SonicWall SMA100

Published · Updated

Follow this CVE+ Monitor SMA100

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

88Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.5epss 100%
from disclosure to weapon
Published on NVDDec 17
CISA KEV+687d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

An unauthenticated attacker can read sensitive data they shouldn't have access to on SonicWall SMA100 devices running version 9.0.0.3 or earlier. This allows unauthorized information disclosure without needing valid credentials.

Technical detail

SQL injection vulnerability (CWE-89) in SonicWall SMA100 enables unauthenticated remote attackers to bypass authentication controls and execute arbitrary SQL queries, resulting in read-only access to unauthorized database resources. The vulnerability affects versions 9.0.0.3 and earlier, with no authentication required as a pre-condition.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100 version 9.0.0.3 and earlier.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
SonicWall · SMA100
Related CVEs — SonicWall SMA100

In the same product, most dangerous first.

CVE-2023-44221HIGHCVE-2023-44221EPSS 76.3%KEVCVE-2021-20035MEDIUMCVE-2021-20035EPSS 4.4%KEVCVE-2019-7483HIGHCVE-2019-7483EPSS 4.0%KEVCVE-2021-20034—CVE-2021-20034EPSS 81.8%CVE-2025-32821HIGHCVE-2025-32821EPSS 23.5%CVE-2022-1703—CVE-2022-1703EPSS 13.0%