SonicOS CVE-2026-0516

The management web interface of SonicOS must be reachable over the network by the attacker, and the attack is most impactful when the management interface is accessible from untrusted networks (internet-facing). The CVSS vector specifies PR:N, confirming no authentication is required to send the malicious Host header. Exploitation is constrained in practice by two factors: first, SonicWall recommends and most hardened deployments restrict management access to specific trusted IP ranges or a dedicated management network, which would block unauthenticated external attackers entirely; second, the redirect impact requires that a legitimate management user be in an active session or navigating to the management interface at the time the crafted request is processed, making purely opportunistic exploitation difficult without additional social engineering or on-path positioning. No special feature flag or non-default configuration is stated as required - the vulnerability is present in the default management interface behavior of affected firmware versions.

The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, score 6.5) rates this as a Medium severity vulnerability with a network-accessible, low-complexity, unauthenticated attack surface and limited confidentiality and integrity impact. The UI:N metric warrants scrutiny: Host header injection leading to user redirection typically requires a management user to be actively browsing the management interface at the time of the attack, which many frameworks score as UI:R. This inconsistency should be verified against SonicWall's PSIRT advisory at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0009. No EPSS score is present in the provided data, no CISA KEV listing exists, and no public exploit code has been identified - these signals collectively indicate low immediate exploitation pressure. The principal real-world risk is targeted phishing: an attacker who can position themselves on-path to the management interface, or who can socially engineer a management user into accessing a crafted URL, could redirect that user to a credential-harvesting site mimicking the SonicOS login page. Risk is elevated in environments where the SonicOS management interface is directly internet-exposed, a configuration SonicWall explicitly discourages. Organizations that follow SonicWall best practice of restricting management access to trusted IP ranges or VPN significantly reduce exploitability despite the PR:N rating.

An attacker identifies a SonicWall firewall with its management interface accessible from the internet and sends an HTTP request to the management portal with a crafted Host header value pointing to an attacker-controlled domain. The SonicOS management interface incorporates the malicious Host value into a redirect response, causing a management user's browser to be sent to a convincing phishing page that mimics the SonicOS login portal, enabling credential theft. No public proof-of-concept code has been identified at time of analysis, but Host header injection is a well-documented and straightforward technique.