EUVD-2026-56942
GHSA-5x5c-7gj2-vq4p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Description specifies local user access, warranting AV:L; root command execution yields full C/I/A impact, not the partial ratings in the official vector.
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root privileges.
AnalysisAI
Command injection in SonicWall Global Management System (GMS) CLI version 9.5.1 and earlier enables a low-privileged user to execute arbitrary system commands with root privileges, constituting a full local privilege escalation on the GMS management host. The flaw is rooted in CWE-94 (Code Injection) within the CLI component, where unsanitized user input reaches a system command interpreter running at elevated privilege. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged local user account on the GMS system (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 6.3 Medium is driven by low-complexity, low-privilege conditions, but the partial impact ratings (C:L/I:L/A:L) appear to materially understate actual post-exploitation consequence - root command execution on a management host typically implies full system compromise, not merely marginal confidentiality, integrity, and availability degradation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a low-privileged local account on a GMS host - through credential theft, insider access, or prior compromise of another account on the system - accesses the GMS CLI and submits a crafted input string containing OS command metacharacters or injection tokens. The CLI passes this input unsanitized to a system command interpreter executing at root privilege, causing the injected commands to run with full system access. … |
| Remediation | The primary remediation is to upgrade SonicWall GMS to the version that resolves SNWLID-2026-0011 per the SonicWall PSIRT advisory at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in SonicWall Global Management System (GMS) 9.5.1 and earlier is possible through an unauthenticat
Insecure deserialization in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier enables a local
Insufficient certificate validation in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier expo
Same weakness CWE-94 – Code Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today