High severity · published Dec 19, 2019
CVE-2019-7486
Code injection in SonicWall SMA100 allows an authenticated user to execute arbitrary code in viewcacert CGI script
8.8
CVSS
1.6%
EPSS
No
On KEV
Description
Code injection in SonicWall SMA100 allows an authenticated user to execute arbitrary code in viewcacert CGI script. This vulnerability impacted SMA100 version 9.0.0.4 and earlier.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
S1
Sma 100 Firmware · Sonicwall
through 9.0.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-7486
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-7486
Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0021
More from Sma 100 Firmware
9.8
CVE-2021-20016
SonicWall SSLVPN SMA100 SQL Injection Vulnerability
7.5
CVE-2019-7483
SonicWall SMA100 Directory Traversal Vulnerability
7.5
CVE-2019-7481
SonicWall SMA100 SQL Injection Vulnerability
9.8
CVE-2019-7482
Stack-based buffer overflow in SonicWall SMA100 allows an unauthenticated user to execute arbitrary code in function libSys.so
8.8
CVE-2025-32820
A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make any directory on the SMA appliance…