EUVD-2026-65747
GHSA-m35m-jcr7-2pvw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Delivering a malicious tarball requires MITM positioning or control of the delivery endpoint, raising AC to H over the vendor's AC:L.
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
Lifecycle Timeline
4DescriptionCVE.org
A Path traversal vulnerability in OPSWAT tarball in the SonicWall NetExtender Linux client allows an attacker to write arbitrary file as root.
AnalysisAI
Arbitrary root file write in SonicWall NetExtender Linux client (versions 10.3.5 and earlier) is achievable by an unauthenticated remote attacker who delivers a malicious OPSWAT tarball containing path-traversal sequences, exploiting CWE-29 to escape the intended extraction directory and overwrite system files as root. Exploitation requires user interaction (CVSS UI:R) to trigger tarball processing, and no public exploit code or CISA KEV listing has been identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target system to run SonicWall NetExtender Linux client version 10.3.5 or earlier, and the OPSWAT tarball processing code path must be triggered - this occurs when a user initiates a VPN connection or compliance check that causes the client to fetch and extract a tarball. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-provided CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high impact across all three dimensions and a network-accessible attack vector with low complexity - consistent with the severity of arbitrary root-level file write. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade SonicWall NetExtender Linux client to a version later than 10.3.5 by consulting the vendor advisory at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0013; the exact patched release number is not independently confirmed in available data and must be verified directly with SonicWall PSIRT. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all systems running SonicWall NetExtender Linux client versions 10.3.5 or earlier and immediately communicate to users that they should not process OPSWAT tarballs from untrusted or unexpected sources; restrict or disable OPSWAT tarball processing where operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. Rated h
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload a
The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerabili
The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabi
Same weakness CWE-29 – Path Traversal: '\\..\\filename'
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today