Measuring the Edge: What ZoomEye Sees When You Search for Exposed Access Gateways

The SonicWall SMA1000 zero-day chain disclosed in September 2026 raised a question that vulnerability advisories rarely answer: how many of these devices are actually reachable from the internet? ZoomEye can help answer it.

The query

To find SonicWall Secure Mobile Access appliances, the product fingerprint is the starting point:

app="SonicWall-SMA"

Run against ZoomEye's IPv4 device dataset, this query returned 7 matching records at the time of collection. Broadening to a free-text search for SonicWall SMA across all data types returned 416 records.
The gap between those two numbers is itself informative. A fingerprint query matches what the scanner can positively identify from the service banner. A free-text query also catches pages and services that mention the product without exposing an identifiable appliance interface. For exposure assessment, the fingerprint count is the more conservative and more defensible figure.

Why the count matters less than the pattern

Seven devices is a small number. It would be a mistake to read that as reassurance.
Shadowserver Foundation tracking during the September 2026 disclosure window counted several hundred SMA1000 instances exposed to the public internet. The difference between that figure and a fingerprint query result comes down to methodology: Shadowserver observes traffic and scanning activity, while a fingerprint query depends on the appliance presenting an identifiable banner on a scanned port.
Both numbers describe the same underlying reality. A meaningful population of authentication gateways sits directly on the internet, and the size of that population depends on how you count.

What the measurement is actually good for

ZoomEye's value here is not a precise census. It is the ability to answer three practical questions quickly.
Is this product class exposed at all? A non-zero fingerprint count confirms that internet-facing instances exist and that the exposure is not hypothetical.
Where is the exposure concentrated? Adding a country facet to a query shows distribution. For context, a query for app="Modbus" returned 9,820 records with the largest country concentrations in Cyprus (3,986), the United States (916), and Sweden (898). Facets turn a single number into a prioritization input.
Did exposure change after disclosure? Running the same query over time shows whether organizations are reducing exposure. A count that stays flat after a widely publicized zero-day is a signal about patch and remediation behavior.

Recording the measurement properly

A measurement is only useful if someone else can reproduce it. Four details belong alongside any ZoomEye figure:

• The exact query string, including operators and quoting.
• The dataset, since IPv4 device data, IPv6 data, and web data return different populations. The figures above come from the combined dataset unless noted.
• The collection time, because exposure changes.
• The unit, meaning what one record represents. A record is an observed service on an address, not necessarily a distinct organization. Without those four elements, a number is an anecdote.

Turning measurement into action

Asset exposure data answers a question that vulnerability scanners cannot: whether a vulnerable system is reachable by someone who has no authorized path into the network. For an edge appliance, that distinction is the whole risk.
The practical workflow is straightforward. Search for the product fingerprint to establish whether exposure exists. Add geographic and organizational facets to see where it concentrates. Compare against your own inventory to find instances you did not know about. Then re-run the query after remediation to confirm the exposure actually decreased.
That last step is the one most often skipped, and it is the only one that verifies the work.

References

• ZoomEye, product fingerprint query app="SonicWall-SMA", combined dataset, collected 2026-09-20. Total: 7 records.
• ZoomEye, free-text query SonicWall SMA, combined dataset, collected 2026-09-20. Total: 416 records.
• ZoomEye, product fingerprint query app="Modbus", combined dataset, collected 2026-09-20. Total: 9,820 records, with country facet distribution.
• CISA, Known Exploited Vulnerabilities Catalog, additions dated September 2, 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• SonicWall Security Advisory SNWLID-2026-0016, September 1, 2026.