EUVD-2026-44410
GHSA-pxc4-295p-35qq
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable AMC (AV:N/AC:L) but requires administrator authentication (PR:H); OS command execution yields total confidentiality, integrity, and availability impact on the appliance (C:H/I:H/A:H).
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
Lifecycle Timeline
3DescriptionCVE.org
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
Articles & Coverage 1
AnalysisAI
Post-authentication OS command execution in the SonicWall SMA1000 Appliance Management Console (AMC) allows a remote attacker holding administrator credentials to inject and run arbitrary operating-system commands on the appliance under specific conditions. It affects SMA1000 firmware branches 12.4.3 and 12.5.0, is confirmed actively exploited (CISA KEV), and has publicly available exploit code, though the EPSS probability sits at a moderate 1.65% (74th percentile), consistent with targeted rather than mass exploitation. Successful abuse yields total control of the management plane of an internet-facing remote-access appliance.
Technical ContextAI
The SMA1000 is SonicWall's Secure Mobile Access appliance line, providing SSL VPN and remote-access services to enterprise users; the Appliance Management Console (AMC) is its administrative web interface. The flaw is classified as CWE-94 (Improper Control of Generation of Code, i.e. Code Injection), meaning user-influenced input reaches a context where it is interpreted as executable code or shell commands rather than inert data, allowing the attacker to break out of the intended input handling and have the underlying OS execute attacker-supplied commands. The affected CPE is cpe:2.3:a:sonicwall:sma1000, and because the AMC runs with elevated appliance privileges, injected commands execute in a high-privilege context on the security device itself.
RemediationAI
Upgrade SMA1000 firmware to a build above the affected ranges - beyond 12.5.0-02800 on the 12.5.0 branch and beyond 12.4.3-03434 on the 12.4.3 branch - per SonicWall advisory SNWLID-2026-0008 (https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008); confirm the exact fixed build number directly from that advisory before scheduling, as the precise patched version is not independently confirmed in the source data. Because exploitation requires administrator access to the AMC, restrict the Appliance Management Console to trusted management networks or a VPN/jump-host rather than exposing it to the internet, and audit for unauthorized admin logins and unexpected OS-level command execution given active exploitation. As additional compensating controls, rotate all administrator credentials and enforce MFA on admin accounts to reduce the chance an attacker obtains the required admin session - trade-off is added operational friction for administrators; also review AMC access logs against the CISA KEV timeline for indicators of prior compromise, since patching alone does not remediate an already-breached appliance.
Server-side request forgery in the SonicWall SMA1000 Appliance Work Place interface lets remote, unauthenticated attacke
Pre-authentication server-side request forgery in the SonicWall SMA1000 secure-access appliance's Work Place interface l
OS command injection in the SonicWall SMA1000 Appliance Management Console (AMC) allows a remote authenticated administr
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today