SonicWall SMA1000 CVE-2026-4112

Attacker must possess valid read-only administrator credentials for the SMA1000 appliance - the CVSS vector PR:H (high privileges required) confirms authenticated access is mandatory. The vulnerability cannot be exploited by unauthenticated attackers, standard VPN users, or lower-privilege accounts. The network vector (AV:N) indicates the management interface must be network-accessible to the attacker, whether via direct internet exposure, internal network access, or VPN connection. Low attack complexity (AC:L) and no user interaction requirement (UI:N) indicate that once an attacker has read-only admin credentials and network access to the management interface, exploitation is straightforward without requiring additional conditions, social engineering, or race conditions. This limits realistic exploitation to scenarios involving compromised administrative credentials, malicious insiders with read-only admin roles, or attackers who have already established presence on networks with access to SMA1000 management interfaces.

Risk prioritization requires balancing multiple signals that present a nuanced picture. CVSS 7.2 indicates significant impact (C:H/I:H/A:H) with scope for complete system compromise, and the network vector (AV:N) with low complexity (AC:L) suggests straightforward exploitation once prerequisites are met. However, the critical limiting factor is PR:H (high privileges required) - attackers must already possess read-only administrator credentials, dramatically reducing the threat surface to insider threats, compromised admin accounts, or chained attacks. EPSS exploitation probability of 0.06% (17th percentile) aligns with this assessment, suggesting minimal observed exploitation interest despite public disclosure. CISA SSVC confirms no active exploitation, non-automatable attack, but acknowledges total technical impact. The confluence of these signals indicates this is a real vulnerability requiring remediation, but not an immediate crisis for most organizations. Priority should increase significantly for environments with: multiple administrative privilege tiers where read-only admins are common, previous incidents of credential compromise, or SMA1000 appliances exposed to untrusted networks. The privilege escalation nature makes this particularly concerning in managed service provider scenarios where read-only access might be delegated.

An attacker who has obtained read-only administrator credentials through phishing, credential stuffing, or insider access logs into the SMA1000 web management interface. They identify input fields in administrative functions that accept SQL commands and craft malicious SQL payloads designed to manipulate database queries. By injecting SQL commands that modify user privilege tables or authentication logic, the attacker escalates their access from read-only to primary administrator, gaining full control over the SMA1000 appliance including VPN configurations, user access policies, and security settings.