CVE-2019-7481 SonicWall SMA100 SQL Injection

Exploited in the wild High 7.5 Published 17 Dec 2019 Updated 12 Aug 2026

Unauthenticated attackers can exploit SQL injection to gain read-only access to unauthorized resources on SonicWall SMA100 devices.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-7481?

CVE-2019-7481 is a high-severity SQL injection vulnerability in SonicWall SMA100, published on 17 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100 version 9.0.0.3 and earlier.

Weakness: CWE-89

Which versions are affected by CVE-2019-7481?

It affects 1 product.

Products include Sonicwall Sma 100 Firmware.

How do I fix CVE-2019-7481?

No fix has been published for CVE-2019-7481 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2019-7481 being exploited?

Yes. Attackers have exploited CVE-2019-7481 in the wild since at least 3 Nov 2021, including in ransomware campaigns.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-229v-p5vr-f583.