EUVD-2026-20902
GHSA-rh6r-h796-j349
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote authenticated attacker with read-only administrator privileges to escalate privileges to primary administrator.
AnalysisAI
SQL injection in SonicWall SMA1000 series appliances allows authenticated attackers with read-only administrator privileges to escalate to primary administrator access through SQL injection vectors. The vulnerability affects SMA1000 versions 12.4.3-03245 and earlier, and 12.5.0-02283 and earlier. While CVSS scores this 7.2 (High) with network-based attack vector and low complexity, real-world exploitation risk appears moderate: EPSS probability is low at 0.06% (17th percentile), CISA SSVC indicates no active exploitation and the attack is not automatable, and the high privilege requirement (existing administrative credentials) significantly limits attacker pool.
Technical ContextAI
This is a SQL injection vulnerability (CWE-89) affecting the SonicWall SMA1000 series secure mobile access appliances, specifically targeting the platform-hotfix versions. SQL injection occurs when user-supplied input is improperly sanitized before being incorporated into SQL queries, allowing attackers to inject malicious SQL commands. The vulnerability exists in functionality accessible to read-only administrators, enabling manipulation of SQL queries to perform unauthorized database operations. The CPE identifier cpe:2.3:a:sonicwall:sma1000:*:*:*:*:*:*:*:* confirms this affects the SMA1000 application platform. Given the network attack vector (AV:N) and administrative interface context, this likely affects the web-based management interface where SQL queries are constructed based on administrative user input without proper parameterization or input validation.
RemediationAI
Upgrade SMA1000 appliances to patched platform-hotfix versions released by SonicWall, available through the vendor's Product Security Incident Response Team (PSIRT) portal at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0003. Organizations should consult the advisory for exact patched version numbers for their 12.4.x or 12.5.x deployment branch. As an immediate compensating control while testing patches, implement strict monitoring and alerting on read-only administrator account activity, particularly database query patterns and privilege escalation attempts - this trades operational overhead for visibility but provides detection capability. Review and minimize the number of accounts with read-only administrator privileges, applying principle of least privilege to reduce attack surface. Consider implementing database activity monitoring if available on the SMA1000 platform to detect SQL injection attempts, though this adds complexity and may impact performance. Enable multi-factor authentication for all administrative accounts to reduce credential compromise risk that enables initial access. For environments unable to patch immediately, restrict network access to administrative interfaces using IP allowlisting or VPN-only access, understanding this does not prevent insider threats or attacks from compromised internal systems.
Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
SonicWall SonicOS SSLVPN contains an authentication bypass vulnerability allowing remote attackers to bypass authenticat
Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. Rated h
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account
SonicWall SMA1000 AMC and CMC contain a pre-authentication deserialization vulnerability allowing unauthenticated remote
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
Server-side request forgery in the SonicWall SMA1000 Appliance Work Place interface lets remote, unauthenticated attacke
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Pre-authentication server-side request forgery in the SonicWall SMA1000 secure-access appliance's Work Place interface l
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today