Sonicwall Sma 100 Firmware — known CVE vulnerabilities

Every CVE whose affected-product data names Sonicwall Sma 100 Firmware, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (13)

• CVE-2021-20016 — CVSS 9.8 (critical) — actively exploited: A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to…
• CVE-2019-7482 — CVSS 9.8 (critical): Stack-based buffer overflow in SonicWall SMA100 allows an unauthenticated user to execute arbitrary code in function libSys.so. This…
• CVE-2019-7485 — CVSS 8.8 (high): Buffer overflow in SonicWall SMA100 allows an authenticated user to execute arbitrary code in DEARegister CGI script. This vulnerability…
• CVE-2019-7486 — CVSS 8.8 (high): Code injection in SonicWall SMA100 allows an authenticated user to execute arbitrary code in viewcacert CGI script. This vulnerability…
• CVE-2025-32819 — CVSS 8.8 (high): A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete…
• CVE-2025-32820 — CVSS 8.8 (high): A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make…
• CVE-2019-7481 — CVSS 7.5 (high) — actively exploited: Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted…
• CVE-2019-7483 — CVSS 7.5 (high) — actively exploited: In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the…
• CVE-2021-20049 — CVSS 7.5 (high): A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration…
• CVE-2021-20050 — CVSS 7.5 (high): An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user…
• CVE-2025-32821 — CVSS 7.2 (high): A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell…
• CVE-2020-5146 — CVSS 7.2 (high): A vulnerability in SonicWall SMA100 appliance allow an authenticated management-user to perform OS command injection using HTTP POST…
• CVE-2019-7484 — CVSS 6.5 (medium): Authenticated SQL Injection in SonicWall SMA100 allow user to gain read-only access to unauthorized resources using viewcacert CGI script…