{"id":"CVE-2019-7481","kind":"vulnerability","aliases":["CVE-2019-7481"],"related":[],"title":"SonicWall SMA100: SonicWall SMA100 SQL Injection Vulnerability","description":"SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources.\n\nCISA required action: Apply updates per vendor instructions.","summary":"SonicWall SMA100 SSL VPN appliances contain an SQL injection flaw that lets an unauthenticated remote user read data they should not see. CISA lists it as actively exploited, and the KEV tag notes ransomware use.","severity":"high","cvss":7.5,"epss":0.99906,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"SonicWall SMA100","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ransomware","self-hosted","sma100","sonicwall","vpn"],"not_affected_if":["not-sma100","patched-firmware"],"how_to_check":"Check the SMA100 firmware version under the appliance's System > Status page against the vendor advisory: unknown from sources.","fix":"Apply the SonicWall SMA100 firmware update per vendor instructions; the specific fixed version is unknown from sources.","status":"open","published_at":"2019-12-17T23:15:14+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:41:29+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:41:29Z","model":"claude-haiku-5-5","output":{"fix":"Apply the SonicWall SMA100 firmware update per vendor instructions; the specific fixed version is unknown from sources.\nUnknown which version is fixed from sources.","reach":"internet","impact":"medium","summary":"SonicWall SMA100 SSL VPN appliances contain an SQL injection flaw that lets an unauthenticated remote user read data they should not see. CISA lists it as actively exploited, and the KEV tag notes ransomware use.","category":"infrastructure","who_cares":["sonicwall","sma100","vpn","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker reads unauthorized data from the VPN appliance","analyst_note":"Find the affected and fixed firmware versions and the vendor advisory from SonicWall, and confirm the ransomware KEV note; see the CISA KEV link in sources.","how_to_check":"Check the SMA100 firmware version under the appliance's System > Status page against the vendor advisory: unknown from sources.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["not-sma100","patched-firmware"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000503,"input_tokens":2836,"output_tokens":439,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2019':9A,12A '-7481':10A,13A 'access':76C 'action':82C 'activ':51B 'allow':67C 'appli':83C 'applianc':29B 'cisa':47B,80C 'contain':30B,62C 'cve':8A,11A 'data':42B 'exploit':16B,52B 'flaw':34B 'gain':72C 'host':21B 'infrastructur':17B 'inject':6A,33B,65C 'instruct':87C 'kev':55B 'let':36B 'list':48B 'note':57B 'per':85C 'ransomwar':18B,58B 'read':41B,74C 'read-on':73C 'remot':39B 'requir':81C 'resourc':79C 'see':46B 'self':20B 'self-host':19B 'sma100':2A,4A,15A,22B,26B,61C 'sonicwal':1A,3A,23B,25B,60C 'sonicwall':14A 'sql':5A,32B,64C 'ssl':27B 'tag':56B 'unauthent':38B,69C 'unauthor':78C 'updat':84C 'use':59B 'user':40B,70C 'vendor':86C 'vpn':24B,28B 'vulner':7A,66C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-12-17T23:15:14+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-7481","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-7481","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T16:39:50+00:00","note":null},{"source":"epss","external_id":"CVE-2019-7481","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-7481","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-7481","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7481","severity":null,"published_at":"2019-12-17T23:15:14+00:00","modified_at":"2026-08-12T05:17:26+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}