CVE-2019-7481
SonicWall SMA100 SQL Injection Vulnerability
Description
CVE-2019-7481 is a high-severity SQL injection vulnerability in SonicWall SMA100 (Secure Mobile Access) appliances. The flaw allows an unauthenticated remote attacker to gain read-only access to unauthorized resources on the target system by exploiting improper neutralization of SQL commands. SonicWall SMA100 firmware versions 9.0.0.3 and earlier are affected. CISA has added CVE-2019-7481 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and this vulnerability is known to be used in ransomware campaigns. With an EPSS score of 94.38% (99.97th percentile), exploitation is near-certain, demanding immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sonicwall | sma 100 firmware | < 9.0.0.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0016(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7481(US Government Resource)
Weakness Type
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
SQL Injection occurs when user-controlled input is incorporated into SQL queries without proper sanitization, allowing attackers to inject malicious SQL code. In the SonicWall SMA100, this weakness enables unauthenticated attackers to manipulate database queries and extract sensitive data from the appliance, including configuration information and credentials, without requiring any authentication.
Learn more: CWE-89 — SQL Injection
Impact Analysis
CVE-2019-7481 carries a CVSS 3.1 score of 7.5 (HIGH), indicating a significant threat to organizations deploying SonicWall SMA100 appliances. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, making it trivially exploitable by any network-accessible attacker. While the scope remains unchanged, the confidentiality impact is rated HIGH, meaning an attacker can gain unauthorized read access to sensitive data stored on the appliance — including potentially cached credentials and VPN session information. The EPSS score of 94.38% places this vulnerability in the 99.97th percentile, indicating near-certain exploitation. Critically, this vulnerability has confirmed usage in ransomware campaigns, making it a high-priority target for threat actors seeking initial access to corporate networks through VPN appliances.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2019-7481 in the wild by including it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-05-03. This vulnerability is known to be used in ransomware campaigns, significantly elevating the urgency of remediation for organizations running vulnerable SonicWall SMA100 appliances. The EPSS score of 94.38% indicates near-certain exploitation activity. SonicWall SMA appliances are frequently targeted by threat actors as they provide VPN access to corporate networks, making a SQL injection vulnerability that enables credential extraction particularly valuable for initial access operations.
Remediation
- Apply updates immediately as required by CISA KEV: upgrade SonicWall SMA100 firmware to version 9.0.0.4 or later, which addresses the SQL injection vulnerability.
- Verify that all SonicWall SMA100 appliances in your environment have been identified and updated. Review the SonicWall PSIRT advisory (SNWLID-2019-0016) for specific firmware upgrade guidance.
- If immediate patching is not feasible, implement web application firewall (WAF) rules to filter SQL injection patterns in requests to the SMA100 appliance, and restrict management access to trusted IP ranges using network segmentation.
- Monitor SMA100 appliance logs for indicators of compromise, including unusual database query patterns, unexpected data access, and unauthorized login attempts using potentially extracted credentials. Review VPN session logs for anomalous access.
- As a long-term measure, ensure all database interactions within the appliance use parameterized queries, implement least-privilege database access, and conduct regular security assessments of internet-facing VPN infrastructure to identify similar vulnerabilities.
Technical Details
CVE-2019-7481 exploits a SQL injection flaw in SonicWall SMA100 firmware versions 9.0.0.3 and earlier. The vulnerability arises because the application fails to properly neutralize special elements in user-supplied input before incorporating it into SQL queries, allowing an unauthenticated attacker to inject malicious SQL code and extract data from the underlying database. The CVSS vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that the vulnerability is network-exploitable with no prerequisites, but its impact is limited to confidentiality — the attacker gains read-only access rather than the ability to modify data or disrupt availability. Despite this read-only limitation, the extracted information from a VPN appliance can include session tokens, cached credentials, and configuration data that enables further attacks against the corporate network.
Frequently Asked Questions
Is CVE-2019-7481 being actively exploited?
Yes. CVE-2019-7481 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. It is also known to be used in ransomware campaigns. The EPSS score of 94.38% (99.97th percentile) indicates near-certain exploitation probability.
What products are affected by CVE-2019-7481?
CVE-2019-7481 affects SonicWall SMA100 appliances running firmware versions 9.0.0.3 and earlier. All SMA100 series devices with firmware prior to version 9.0.0.4 should be updated immediately.
How do I fix CVE-2019-7481?
Upgrade SonicWall SMA100 firmware to version 9.0.0.4 or later. Consult the SonicWall PSIRT advisory SNWLID-2019-0016 for detailed upgrade instructions. If immediate patching is not possible, restrict network access to the appliance and implement WAF rules to filter SQL injection attempts.
How severe is CVE-2019-7481?
CVE-2019-7481 has a CVSS 3.1 score of 7.5 (HIGH) and an EPSS score in the 99.97th percentile. While it provides read-only access, the data exposed from a VPN appliance can include credentials and session information, and it is actively used in ransomware campaigns.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.