What is the CVSS score of EUVD-2026-56942?

EUVD-2026-56942 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 1.2%.

SonicWall GMS EUVD-2026-56942

| CVE-2026-66148 MEDIUM

Code Injection (CWE-94)

2026-08-11 sonicwall

GHSA-5x5c-7gj2-vq4p

RCE Command Injection Code Injection Sonicwall Gms

6.3

CVSS 3.1 · Vendor: sonicwall

Severity by source

Vendor (sonicwall) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.8 HIGH

Description specifies local user access, warranting AV:L; root command execution yields full C/I/A impact, not the partial ratings in the official vector.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (sonicwall).

CVSS VectorVendor: sonicwall

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:51 vuln.today

DescriptionCVE.org

An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root privileges.

AnalysisAI

Command injection in SonicWall Global Management System (GMS) CLI version 9.5.1 and earlier enables a low-privileged user to execute arbitrary system commands with root privileges, constituting a full local privilege escalation on the GMS management host. The flaw is rooted in CWE-94 (Code Injection) within the CLI component, where unsanitized user input reaches a system command interpreter running at elevated privilege. No active exploitation has been confirmed by CISA KEV, no public exploit code has been identified, and SSVC assessment characterizes exploitation status as none with a non-automatable attack path.

Technical ContextAI

SonicWall GMS (Global Management System) is an enterprise network management platform used for centralized administration of SonicWall security appliances. The vulnerable component is the GMS Command-Line Interface (CLI), covering all builds through version 9.5.1 (Build 9510.1044), as identified by CPE cpe:2.3:a:sonicwall:gms:*:*:*:*:*:*:*:*. The root cause class is CWE-94 (Improper Control of Generation of Code - Code Injection), a broad category that encompasses OS command injection (CWE-77/78): user-controlled input is passed without adequate sanitization to a command interpreter that executes in a privileged (root) context, allowing the injected payload to inherit root-level execution permissions rather than the caller's restricted privileges. The tags confirm both code injection and OS command injection patterns are involved in the vulnerability.

RemediationAI

The primary remediation is to upgrade SonicWall GMS to the version that resolves SNWLID-2026-0011 per the SonicWall PSIRT advisory at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011. An exact patched version number is not specified in the available data and must be obtained directly from the vendor advisory before scheduling the upgrade. As a compensating control pending patch deployment, restrict access to the GMS host at the network level - enforce firewall ACLs or jump-host controls to limit who can reach the GMS management interface or OS console, and audit all local OS-level accounts provisioned on the GMS host, removing any that are not operationally required. If the CLI is accessible over SSH, restrict SSH access to named administrative accounts with strong authentication and consider disabling password-based SSH in favor of key-based authentication. Note that restricting CLI access may affect legitimate administrative workflows, so changes should be validated against operational runbooks before deployment.