SQL Injection (CVE‑2019‑7481) Grants Unauthenticated Read‑Only Access in SonicWall SMA100 Appliances
What It Is – SonicWall’s SMA100 SSL‑VPN appliance contains an unauthenticated SQL‑injection flaw that lets an attacker issue crafted queries against the device’s internal database. The bug yields read‑only access to resources that should be restricted to privileged users.
Exploitability – Public proof‑of‑concept code exists; the vulnerability is rated High (CVSS 7.5) and can be exploited over the network without credentials.
Affected Products – SonicWall SMA100 (all firmware versions prior to the vendor’s June 2020 security update).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability management of network‑edge devices, a control that maps to many frameworks (e.g., NIST CSF Identify & Protect).
- Highlights gaps in access‑control enforcement; unauthenticated read‑only access undermines the audit trail required for compliance reviews.
- Provides a concrete evidence point for continuous monitoring – proof that the device is patched and that logs show no anomalous queries.
Recommended Actions
- Verify firmware version on every SMA100 appliance; upgrade to the SonicWall‑released patch (or later).
- Run an authenticated scan of all SSL‑VPN devices to confirm the vulnerability is remediated.
- Enable detailed query‑logging on the appliance and integrate logs into a SIEM for continuous monitoring.
- Update your vulnerability‑management inventory to include network‑edge assets and schedule regular re‑assessment.
Source: CISA KEV – CVE‑2019‑7481