CVE-2019-7481: SonicWall SMA100 SQL injection, unauthenticated data access
The short version: SonicWall SMA100 access appliances have a SQL-injection flaw (CVE-2019-7481) that lets an unauthenticated attacker run database queries and read unauthorized data. It's in CISA's KEV catalog and associated with ransomware activity targeting SMA devices. If you run an affected build on the internet, patch it. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice (see below) |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 99.91% · 99.97th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2022-05-03 |
| Known exploited? | Yes — CISA notes known ransomware use |
| Vulnerability type | CWE-89 SQL injection → unauthenticated read of unauthorized data |
| Requires authenticated session? | No — pre-authentication |
| Affected | SonicWall SMA100 build 9.0.0.3 and earlier |
| Fixed in | SMA100 9.0.0.4 or later |
What you need to know
CVE-2019-7481 is a SQL injection in the SMA100 appliance. By injecting SQL into a request parameter, an unauthenticated attacker can run database queries and pull back data — usernames, session information, and other records the application shouldn't expose to a stranger.
Why it earns priority:
- It's an internet-facing access appliance. SMA100 devices front remote access, so the vulnerable surface is exposed by design.
- It's unauthenticated read access. No credentials needed — the injection returns data directly.
- It's in KEV with ransomware association. SonicWall SMA appliances have been a repeated target for ransomware operators; CISA flags known ransomware use for this flaw.
How serious we see it
High — in practice.
The 7.5 base score reflects a confidentiality-only impact, and this is data disclosure rather than code execution. We rate it High because of context: unauthenticated data access on an internet-facing access appliance, in KEV, tied to ransomware, with EPSS effectively at the ceiling. Session information and credentials pulled this way can become the doorway to authenticated access — which is how these appliances tend to get compromised. It's below Critical because it reads rather than executes; the reassuring part is that it's a specific, patchable build and quick to confirm.
Recommendations
Straight from SonicWall's advisory (SNWLID-2019-0016) and CISA:
- Patch now. Upgrade SMA100 to 9.0.0.4 or later.
- Rotate credentials and sessions. If the appliance was exposed while vulnerable, treat account and session data as potentially disclosed and rotate.
- Enforce MFA. Ensure MFA is required for remote-access accounts fronted by the appliance.
- Restrict reachability. Keep the management surface off the public internet; limit access to trusted networks.
- Confirm your exposure first. Verify whether you run an affected, internet-facing SMA100 build.
How BreachRisk sees it
BreachRisk discovers internet-facing SonicWall SMA appliances from little more than your domain, fingerprints the product and version, and flags exposure tied to CVE-2019-7481 — raised to the top because it's in KEV and tied to ransomware. Where authorized, it goes a step past a scanner: it sends a safe, bounded SQL-injection check using a benign arithmetic payload and looks only for the calculated result in the response, confirming the injection point without extracting your data.
That's the honest difference between "this build looks affected" and "we confirmed the injection responds" — surfaced continuously, so the exposed appliance is already mapped before an attacker gets there.