EUVD-2026-69707
GHSA-vxcc-7cf2-wcgh
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description explicitly states remote access and administrator-level privilege; 'specific conditions' elevates AC to H; full OS command execution justifies C:H/I:H/A:H.
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
Lifecycle Timeline
6DescriptionCVE.org
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
Articles & Coverage 1
AnalysisAI
OS command injection in the SonicWall SMA1000 Appliance Management Console (AMC) allows a remote authenticated administrator to execute arbitrary OS commands under specific conditions, achieving full remote code execution on the appliance. The vulnerability (CWE-78) is post-authentication and gated by administrator-level credentials, narrowing the exploitable attack surface to compromised or malicious admin accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated administrator session on the SMA1000 Appliance Management Console - effectively PR:H in practice, despite the vendor CVSS listing PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS vector (AV:L/AC:L/PR:L) is materially inconsistent with the description, which explicitly characterizes the attacker as 'remote' and operating 'as administrator.' Local attack vector and low privilege are both contradicted by those qualifiers; this discrepancy should be verified directly against SNWLID-2026-0016. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the SonicWall PSIRT advisory SNWLID-2026-0016 (https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016) for the vendor-released firmware update; no specific fixed version number is confirmed in available data, so patch status is pending direct advisory review. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, restrict network access to all SMA1000 AMC instances to authorized administrative IP ranges only via firewall rules, disabling or blocking management interface access from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery in the SonicWall SMA1000 Appliance Work Place interface lets remote, unauthenticated attacke
Pre-authentication server-side request forgery in the SonicWall SMA1000 secure-access appliance's Work Place interface l
Post-authentication OS command execution in the SonicWall SMA1000 Appliance Management Console (AMC) allows a remote att
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today