CVE-2019-7481

What is SonicWall SMA100?

The SonicWall Secure Mobile Access (SMA) 100 series is an SSL-VPN appliance that organizations use to give remote employees encrypted access to internal applications and file shares — a security gateway product that, if compromised, hands an attacker a foothold directly inside the corporate network.

Overview

CVE-2019-7481 is a SQL injection vulnerability (CWE-89) in SMA100 that lets an unauthenticated remote attacker query the appliance's backend database and obtain read-only access to data they shouldn't be able to reach, including potentially sensitive account information. It carries a high severity score (CVSS 7.5), and CISA flags it for confirmed ransomware use.

Technical Details

The SMA100 web management/portal interface fails to properly sanitize user-supplied input before incorporating it into a SQL query, allowing an attacker to manipulate the query logic and extract data the application did not intend to expose. Because it requires no authentication and no user interaction, it is exploitable directly over the network with a single crafted request.

Discovery

Patched by SonicWall in SMA 100 series firmware released in late 2019; NVD does not credit an individual external researcher.

Exploitation Context

SonicWall's SMA100 line has repeatedly been targeted by ransomware affiliates and other financially motivated intruders using SSL-VPN vulnerabilities as an initial-access vector, including well-documented incidents where attackers combined older, unpatched SMA100 flaws with newer ones to breach networks. CISA's ransomware-use flag on this entry reflects that broader pattern of SMA100 devices being high-value initial-access targets.

Remediation

1. Update SMA100 firmware to the latest version provided by SonicWall.
2. Verify that previously issued patches were fully applied — some organizations have historically run appliances at incomplete patch levels.
3. Restrict SMA100 administrative and portal access with additional network-layer controls (IP allow-listing, VPN-in-front-of-VPN) where feasible.
4. Enable multi-factor authentication for all remote-access accounts using the appliance.
5. Review authentication and database access logs for signs of SQL injection attempts or unauthorized data access.