{"id":"CVE-2019-7481","published":"2019-12-17T23:15:14Z","modified":"2026-08-12T05:17:26Z","title":"SonicWall SMA100 SQL Injection Vulnerability","vendor":"SonicWall","product":"SMA100","tier":"core","eol":null,"description":{"text":"Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100 version 9.0.0.3 and earlier.","provenance":"source","from":"NVD"},"summary":{"text":"The SonicWall SMA100 product contains a SQL injection flaw, classified as improper neutralization of special elements used in an SQL command, affecting version 9.0.0.3 and earlier. An unauthenticated remote attacker with network access can exploit it without user interaction to gain read-only access to unauthorized resources.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:08Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.99906,"percentile":0.99966,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-7481","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-11-03","exploitedFirstSeen":"2021-11-03","ransomware":true,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/csw_final_ransomware_index-update-q321-csw_.pdf","date":"2021-11-10"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/ransomware-_-2022-spotlight-report_compressed.pdf","date":"2022-01-26"},{"url":"https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/2022-unit42-ransomware-threat-report-final.pdf","date":"2022-03-24"},{"url":"https://static.tenable.com/marketing/whitepapers/Whitepaper-Ransomware_Ecosystem.pdf","date":"2022-06-22"},{"url":"https://www.theregister.com/2023/03/09/suspected_chinese_cyberspies_target_uppatched/","date":"2023-03-09"},{"url":"https://cert-in.org.in/PDF/RANSOMWARE_Report_2022.pdf","date":"2023-04-22"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2024-0208.pdf","date":"2024-02-08"},{"url":"https://www.greynoise.io/blog/battling-ransomware-one-tag-at-a-time","date":"2024-02-08"},{"url":"https://blog.barracuda.com/2024/03/06/threat-spotlight-shellshock-bugs-miners","date":"2024-03-06"}],"evidenceTotal":14,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0016","tags":["Vendor Advisory"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0016","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7481","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated exploitation of public-facing SMA appliance","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allow unauthenticated user to gain read-only access","start":34,"end":85}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Read-only access to unauthorized data resources","mappingType":"primary_impact","evidence":[{"from":"description","quote":"gain read-only access to unauthorized resources","start":64,"end":111}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-17023","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-17023","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2019-7481","name":"SonicWall SRA 4600 VPN - SQL Injection","severity":"high","path":"http/cves/2019/CVE-2019-7481.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7481.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2019-12-17","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7481","provenance":"source"},{"date":"2021-11-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-17023","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":687},"priority":{"score":78.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1821 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}