Actively exploited in the wild
SonicWall SMA100 Directory Traversal Vulnerability
SonicWall - SMA100 · Listed in the CISA KEV since 2022-03-28. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2019-7483
HighCVSS 7.5KEVSummary
In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server. The vulnerability does not allow reading file contents, only detecting their existence.
Risk Assessment
An attacker could gain information about the file structure on the server, which may facilitate further attacks. Although the direct risk is limited, the information disclosure could be used in later stages of an attack.
Recommendation
Update SonicWall SMA100 firmware to the latest version containing the fix. Additionally, consider restricting access to the management interface from untrusted networks.
Other vulnerabilities in SonicWall SMA100
See all- CVE-2021-20016CriticalActively exploited
A SQL injection vulnerability in SonicWall SSLVPN SMA100 allows a remote unauthenticated attacker to perform SQL queries to access usernames, passwords, and other session-related information. This affects SMA100 build version 10.x.
- CVE-2019-7481HighActively exploited
A vulnerability in SonicWall SMA100 allows an unauthenticated user to gain read-only access to unauthorized resources. This affects SMA100 version 9.0.0.3 and earlier.
Original NVD description (English source)
In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.