CVE-2019-7483
SonicWall SMA100 Directory Traversal Vulnerability
Description
CVE-2019-7483 is a directory traversal vulnerability in SonicWall SMA100 series appliances that allows an unauthenticated remote attacker to read arbitrary files from the affected device by manipulating file path parameters in HTTP requests. The vulnerability exists in the web interface of the SMA100, which fails to properly validate and sanitize path inputs. CISA added CVE-2019-7483 to the Known Exploited Vulnerabilities catalog on March 28, 2022, confirming active exploitation in the wild. With an EPSS score of 26.0% (96.8th percentile), this vulnerability is heavily targeted by threat actors seeking to access credentials and configuration data on SonicWall VPN appliances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sonicwall | sma 100 firmware | < 9.0.0.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0018(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7483(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 describes a weakness where software uses external input to construct a file pathname without properly neutralizing special directory traversal characters, allowing access to files outside the intended directory. In CVE-2019-7483, the SonicWall SMA100 web interface fails to sanitize path parameters, enabling an attacker to traverse the file system and read sensitive files.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
CVE-2019-7483 enables unauthenticated file read access on SonicWall SMA100 appliances, which function as critical SSL-VPN gateways for organizations. An attacker can exploit this vulnerability to read configuration files containing VPN user credentials, session tokens, and network topology information, providing a direct path to unauthorized internal network access. The confidentiality impact is severe because SMA100 appliances store sensitive authentication data that, once compromised, can be used for VPN session hijacking or credential-based attacks against internal resources. Given the network perimeter role of these appliances, successful exploitation can serve as the initial foothold for broader network compromise.
Exploit Maturity
CVE-2019-7483 is confirmed as actively exploited in the wild by CISA, which added it to the KEV catalog on March 28, 2022. The EPSS score of 26.0% (96.8th percentile) reflects very high exploitation probability, consistent with the known targeting of SonicWall VPN appliances by both financially motivated threat actors and advanced persistent threats. Public exploit code is available, and the unauthenticated, pre-authentication nature of the vulnerability makes it readily exploitable with minimal effort.
Remediation
- Update SonicWall SMA100 firmware to the latest patched version as specified in the SonicWall security advisory addressing CVE-2019-7483.
- If immediate patching is not possible, restrict access to the SMA100 web interface to trusted IP ranges using network-level access controls.
- Enable multi-factor authentication (MFA) for all VPN users to reduce the impact of any credential exposure resulting from file read exploitation.
- Audit SMA100 access logs for anomalous file access patterns and path traversal indicators in HTTP request URLs.
- Rotate all VPN user credentials and shared secrets stored on the SMA100 appliance after applying the security update.
Technical Details
CVE-2019-7483 is a directory traversal vulnerability in the web interface of SonicWall SMA100 series appliances. The vulnerability is caused by insufficient input validation of file path parameters in HTTP requests processed by the SMA100 web server. By including directory traversal sequences (e.g., ../) in request parameters, an unauthenticated remote attacker can escape the intended web root directory and read arbitrary files on the appliance filesystem. The attack requires no authentication and can be conducted remotely over HTTP/HTTPS with low complexity, targeting sensitive files such as VPN user databases, session stores, and system configuration files.
Frequently Asked Questions
Is CVE-2019-7483 being actively exploited?
Yes, CVE-2019-7483 is confirmed as actively exploited in the wild by CISA, which added it to the KEV catalog on March 28, 2022. The EPSS score of 26.0% (96.8th percentile) confirms high real-world exploitation activity targeting SonicWall SMA100 VPN appliances.
What products are affected by CVE-2019-7483?
CVE-2019-7483 affects SonicWall SMA100 series appliances running vulnerable firmware versions. This includes SMA 200, SMA 210, SMA 400, and SMA 410 models that have not been updated with the security patch.
How do I fix CVE-2019-7483?
Update the SonicWall SMA100 firmware to the latest patched version per the SonicWall security advisory. After patching, rotate all VPN user credentials and enable multi-factor authentication to mitigate any prior credential exposure.
How severe is CVE-2019-7483?
CVE-2019-7483 is a high-severity directory traversal vulnerability that allows unauthenticated remote file reads on SonicWall SMA100 VPN appliances. With an EPSS score in the 96.8th percentile, active exploitation confirmed by CISA, and the sensitive nature of data accessible on VPN appliances, this vulnerability should be treated as a critical priority for remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.