SonicOS CVE-2026-0205

Exploitation requires the attacker to be authenticated to SonicOS (the description explicitly states 'post-authentication') - note this conflicts with PR:N in the provided CVSS vector, which should be verified against the vendor advisory. The attacker must have adjacent network access to the SonicOS management or service interface (AV:A), meaning exploitation is limited to the same LAN segment, management VLAN, or VPN-connected network - not reachable from the open internet. User interaction is required (UI:R), adding an additional exploitation barrier. Limiting factors: requires valid SonicOS credentials (likely operator or user-level); restricted to adjacent network segments; not automatable per SSVC; no known public exploit reduces drive-by risk. The vulnerability is not default-exploit-ready from the internet.

Despite a moderate CVSS base score of 6.8, multiple signals converge to indicate low-priority real-world risk. EPSS is 0.01% (2nd percentile), SSVC classifies exploitation as none and automatable as no, and KEV status is absent - all pointing away from active or near-term exploitation. The high availability impact (A:H) is the most operationally significant signal, suggesting a successful exploit could disrupt firewall or VPN services, a meaningful risk for network-dependent environments. IMPORTANT CONFLICT: The description explicitly states 'post-authentication' (implying PR:L or PR:H), yet the provided CVSS vector specifies PR:N (no privileges required). This is a notable scoring inconsistency that should be verified against the SonicWall PSIRT advisory SNWLID-2026-0004; if authentication is truly required, actual exploitability is materially lower than PR:N implies. UI:R in the vector adds an additional barrier. Overall, this is a real but low-urgency finding, most relevant to environments where SonicOS management interfaces are exposed to adjacent untrusted networks.

An attacker authenticated to a SonicOS management interface from an adjacent network segment (such as a shared management VLAN or LAN) crafts an HTTP request containing path traversal sequences targeting an internal service endpoint. The traversal bypasses access controls on the service layer, allowing the attacker to interact with restricted internal services - potentially disrupting firewall availability or reading limited internal data. No public exploit code has been identified, and the user-interaction requirement (UI:R) may necessitate social engineering or session hijacking to trigger under real-world conditions.