CVE-2019-7481
The CVSS 7.5 rating for CVE-2019-7481 materially undersells its actual threat profile. This is an unauthenticated vulnerability in the SonicWall SMA100, a network edge appliance that terminates VPN sessions and brokers authentication for your entire remote access infrastructure. CISA has confirmed active exploitation. EPSS scores this at 0.99906 — effectively 100% predicted exploitation likelihood. A 7.5 High rating suggests moderate severity; a confirmed, actively exploited, unauthenticated flaw against an auth broker suggests something far more urgent. The disconnect between CVSS and EPSS here isn't a scoring anomaly — it's a structural gap. CVSS measures theoretical impact at disclosure. EPSS measures empirical exploitation probability. When these diverge this sharply, treat EPSS as the operational signal and CVSS as a floor, not a ceiling. The vague description — 'read-only access to unauthorized resources' — obscures what actually matters. For a device that handles VPN authentication, that read access almost certainly includes session tokens, LDAP mappings, and configuration data containing credentials. The ambiguity isn't accidental; it's a disclosure pattern common to edge authentication hardware. Treat any unauthenticated read access to an auth broker as credential-adjacent by default until proven otherwise. The compounding risk is the real problem. Compromising the SMA100 doesn't expose contained data — it exposes the authentication pathway for your entire remote workforce. Every VPN credential, every session token, every LDAP binding passes through that gateway. That's a blast radius multiplier CVSS cannot model. For containment: identify all SMA100 devices running version 9.0.0.3 or earlier. Isolate or monitor intensively. Assume credential material is exposed and rotate VPN secrets, session tokens, and any credentials that passed through the device. The patch exists (9.0.0.4), but the gap between disclosure and remediation across many organizations has been measured in years — that's institutional inertia, not triage failure. Prioritize now, not because of the CVSS score, but because the device's architectural position makes it a pivot point, not a target in isolation.
Reviewed through automated stages and approved by a human before publication.