EUVD-2026-94324
GHSA-xww4-pc4h-x9hj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Pre-auth, network, low-complexity SSRF with scope change (S:C) reaching internal functions gives C:H; 'unauthorized operations' supports only I:L, and SSRF does not clearly impact availability (A:N).
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
Lifecycle Timeline
5DescriptionCVE.org
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.
AnalysisAI
Pre-authentication server-side request forgery in the SonicWall SMA1000 Appliance's Work Place interface lets a remote attacker who can reach the appliance abuse an unintended alternate access path that bypasses authentication and coerce the device into issuing requests on the attacker's behalf, reaching internal functionality that is not otherwise exposed externally (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - high confidentiality impact, low integrity impact, no availability impact). Affected builds are SMA1000 12.4.3-03526 (platform-hotfix) and older, and 12.5.0-02952 (platform-hotfix) and older; because the Work Place portal is normally internet-facing on these remote-access appliances, exposure is broad and this is a genuine top-priority vulnerability rather than a high-CVSS-but-low-risk artifact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the SMA1000 Appliance 'Work Place' interface, which on these remote-access VPN appliances is typically internet-facing by deployment design. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority vulnerability, not a high-CVSS-but-low-risk artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact fixed build identifier is provided in the available intelligence, so the authoritative fix must be taken from SonicWall's PSIRT advisory SNWLID-2026-0017 at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017 - upgrade any SMA1000 running 12.4.3-03526 (platform-hotfix) or older, and any running 12.5.0-02952 (platform-hotfix) or older, to the newest platform-hotfix build SonicWall lists as fixed, and treat 'patch availability not independently confirmed' as a reason to confirm directly with the vendor rather than assume the shipped build is remediated. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SMA1000 appliances, confirm which are internet-facing, and restrict or block external access to the Work Place interface at the perimeter (allow-listing only known trusted source ranges), while applying virtual patching or SSRF-blocking rules on any upstream WAF/IPS and enabling verbose logging and alerting on anomalous outbound requests originating from the appliance; treat affected builds - SMA1000 12.4.3-03526 (platform-hotfix) and older, and 12.5.0-02952 (platform-hotfix) and older - as the priority scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
SonicWall SonicOS SSLVPN contains an authentication bypass vulnerability allowing remote attackers to bypass authenticat
Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. Rated h
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account
SonicWall SMA1000 AMC and CMC contain a pre-authentication deserialization vulnerability allowing unauthenticated remote
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
Server-side request forgery in the SonicWall SMA1000 Appliance Work Place interface lets remote, unauthenticated attacke
Pre-authentication server-side request forgery in the SonicWall SMA1000 secure-access appliance's Work Place interface l
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform
Share
External POC / Exploit Code
Leaving vuln.today