EUVD-2026-53334
GHSA-43cm-mrxj-qjr8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Redirect exploitation delivers impact only when a management user is actively browsing the interface, justifying UI:R over the vendor's UI:N.
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
Lifecycle Timeline
3DescriptionCVE.org
A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirect firewall management users to arbitrary web domains.
AnalysisAI
Host header injection in SonicWall SonicOS enables remote unauthenticated attackers to manipulate the HTTP Host header on the firewall management interface, causing redirect responses that send management users to attacker-controlled web domains. Affected version branches span the SonicOS 6.5, 7.0, 7.3, and 8.2 lines, covering a wide installed base of SonicWall firewalls. No public exploit code exists and this vulnerability has not been added to CISA KEV at time of analysis, but the unauthenticated network-accessible attack surface and management-user targeting make it a meaningful phishing risk in environments where the management interface is internet-exposed.
Technical ContextAI
CWE-644 (Improper Neutralization of HTTP Headers for Scripting Syntax) describes a class of flaws where an application fails to sanitize user-supplied HTTP header values before incorporating them into server-generated responses. In this case, SonicOS's management web interface processes the HTTP Host header and uses it to construct redirect responses or internal links, without validating or stripping attacker-supplied values. The affected product is identified via CPE as cpe:2.3:a:sonicwall:sonicos:*:*:*:*:*:*:*:*, encompassing all SonicOS editions across the affected version ranges. SonicOS is the operating system powering SonicWall's NGFWs and UTM appliances, and its management interface is typically HTTPS-accessible on a dedicated management port or IP. Host header injection at the HTTP layer is a well-understood vector distinct from XSS or SSRF, primarily enabling open redirects and, in some implementations, cache poisoning or password-reset link hijacking - the specific impact here is scoped to redirect manipulation.
RemediationAI
Consult the SonicWall PSIRT advisory SNWLID-2026-0009 at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0009 for patched firmware versions across each affected branch; the provided input data lists the last-vulnerable versions (6.5.5.1-6n, 7.0.1-5169, 7.3.3-7015, 8.2.1-8010) but does not specify exact remediated release numbers, so patched firmware versions are not independently confirmable from the data supplied here. The primary compensating control - regardless of patch availability - is restricting access to the SonicOS management interface to trusted IP addresses only, which eliminates the network-accessible attack surface for unauthenticated attackers; this is already a SonicWall hardening recommendation and carries no functional trade-offs for most deployments. Additionally, ensuring management access occurs only over a dedicated management VLAN or out-of-band network further limits the exposure window. If management must remain accessible from broader networks, enabling multi-factor authentication for administrative accounts limits the phishing blast radius, since stolen credentials alone would not complete the attack chain.
SonicWall SonicOS SSLVPN contains an authentication bypass vulnerability allowing remote attackers to bypass authenticat
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (
Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). Rated critical severity (CVSS 9.8), this v
Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. Rated high severity (CVSS 7.5), this vulne
A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially lea
An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific con
A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially exe
Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). Rated critical seve
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). Rated critical severity (CVSS
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. Rated critical severity (CVSS 9.8), this vul
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today