Global Management System Gms
Monthly
Unauthenticated remote attackers who can reach a SonicWall GMS 9.5.2 or earlier management interface can read internal GMS files, potentially exposing sensitive information held on the appliance. The independently assessed vector is AV:N/AC:L/PR:N/UI:N with high confidentiality impact and no integrity or availability impact, and exposure is greatest where GMS is internet-facing or reachable from untrusted networks. No public exploit identified at time of analysis and CISA SSVC records no known exploitation, so the priority is monitor rather than emergency.
SQL injection in the End-of-Life SonicWall Global Management System (GMS) 9.5.2 and earlier allows an attacker who already holds high-privilege credentials on the GMS management interface to read or modify data held in the GMS database. The vendor restricts practical exploitation to unspecified 'specific conditions', and the exact vulnerable parameter or feature is not described in the available sources; no public exploit is identified at time of analysis and the issue is not reported as actively exploited. With CVSS 6.8 and a this_month prioritization label, the practical exposure is concentrated in organizations still running the unsupported 9.5.x branch rather than in the general internet-facing population.
Unauthenticated remote attackers who can reach a SonicWall GMS 9.5.2 or earlier management interface can read internal GMS files, potentially exposing sensitive information held on the appliance. The independently assessed vector is AV:N/AC:L/PR:N/UI:N with high confidentiality impact and no integrity or availability impact, and exposure is greatest where GMS is internet-facing or reachable from untrusted networks. No public exploit identified at time of analysis and CISA SSVC records no known exploitation, so the priority is monitor rather than emergency.
SQL injection in the End-of-Life SonicWall Global Management System (GMS) 9.5.2 and earlier allows an attacker who already holds high-privilege credentials on the GMS management interface to read or modify data held in the GMS database. The vendor restricts practical exploitation to unspecified 'specific conditions', and the exact vulnerable parameter or feature is not described in the available sources; no public exploit is identified at time of analysis and the issue is not reported as actively exploited. With CVSS 6.8 and a this_month prioritization label, the practical exposure is concentrated in organizations still running the unsupported 9.5.x branch rather than in the general internet-facing population.