A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• sonicwall sma 100 firmware10.0.0.0 and later · before 10.2.0.5-d-29sv
• sonicwall sma 200 firmwareall versions
• sonicwall sma 210 firmwareall versions
• sonicwall sma 400 firmwareall versions
• sonicwall sma 410 firmwareall versions
• sonicwall sma 500vall versions

Versions reported by the vendor

Affected version ranges reported by the assigning authority (sonicwall). Independent of NVD's CPE analysis and usually ahead of it.

• SonicWall SonicWall SMA100

  • SMA100 build version 10.xaffected

Other highest-scoring records for the same primary product.

• CVE-2019-7481Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources.KEV
  90Now
• CVE-2019-7483In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the preseKEV
  61This week
• CVE-2019-7482Stack-based buffer overflow in SonicWall SMA100 allows an unauthenticated user to execute arbitrary code in function libSys.so.
  42Plan
• CVE-2025-32819A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete
  37Monitor
• CVE-2025-32820A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make an
  36Monitor
• CVE-2019-7486Code injection in SonicWall SMA100 allows an authenticated user to execute arbitrary code in viewcacert CGI script.
  35Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The query text is built by concatenating user input. The database cannot tell where the data ends and the command begins.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = '" + owner + "'"4);

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = $1",4  [owner]5);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.