Measuring the Edge: What ZoomEye Sees When You Search for Exposed Access Gateways

The SonicWall SMA1000 zero-day vulnerability disclosed in September 2026 sparked questions about the extent of exposed devices on the internet. ZoomEye, a vulnerability intelligence platform, can provide answers to this question. By querying ZoomEye's IPv4 device dataset with the product fingerprint "app = SonicWall-SMA," only seven matching records were returned at the time of collection.

Increasing the search to a free-text search for "SonicWall SMA" across all data types yielded 416 records. This discrepancy highlights the difference between a fingerprint-based query, which identifies devices by identifying banners, and a free-text query, which captures any mentions of the product without exposing an identifiable interface.

For exposure assessment, the fingerprint query count is more conservative and defensible. The seven devices found in the fingerprint query might seem insignificant, but they represent a meaningful population of authentication gateways directly on the internet. Factors such as methodology differences and the appliance's banner presentation contribute to the gap between the two figures.

ZoomEye's primary value lies in quickly answering three practical questions: whether the product class is exposed, where the exposure is concentrated, and whether exposure has changed after disclosure. By tracking exposure over time, organizations can gauge the effectiveness of patching and remediation efforts. To ensure the utility of ZoomEye's measurements, four details should accompany any figure: the exact query string, the dataset used, the collection time, and the unit of measurement.

A record represents an observed service on an address, not necessarily a distinct organization. Properly recording these details allows the number to serve as a factual reference rather than an anecdote. Ultimately, understanding asset exposure data helps differentiate between vulnerable systems and those that are truly reachable by unauthorized parties, directly impacting the overall risk assessment of an organization's edge appliances.