Network Security Manager Nsm
Monthly
Authenticated attackers with high privileges on SonicWall Network Security Manager (NSM) on-prem can execute arbitrary OS commands via an OS command injection flaw (CWE-78), achieving remote code execution. The vulnerability affects NSM on-prem versions 4.3.1 and earlier, requires a privileged session (PR:H), and is assessed with high attack complexity (AC:H) due to unenumerated specific conditions. No public exploit code or active exploitation has been identified (CISA KEV status: none; SSVC exploitation: none), and the EPSS score is 0.54% (44th percentile), indicating a moderate-priority risk rather than an urgent emergency.
Improper access control in the export settings feature of SonicWall Network Security Manager (NSM) on-prem let a remote authenticated attacker with only low-privilege NSM credentials retrieve sensitive information that should be restricted to higher-privileged users, which the vendor states could be used to escalate to administrator or to intercept other NSM users' communications. Affected deployments are NSM on-prem 4.3.1 and earlier; the hosted/SaaS NSM is not indicated as in scope, and exploitation requires a valid account plus access to the export settings functionality (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no public exploit code identified at time of analysis, no confirmed active exploitation (SSVC Exploitation: none), and EPSS is low at 0.20% (10th percentile), so this is a genuine but not emergency-grade priority - its realistic impact presumes a multi-user NSM deployment in which other privileged accounts or traffic exist to leverage.
Arbitrary file write via Zip Slip in SonicWall Network Security Manager (NSM) On-Prem (versions 4.3.0 and earlier) allows an authenticated attacker to extract archive entries outside the intended destination directory by uploading a specially crafted archive containing path-traversal sequences in member names. Because the management platform processes uploaded archives without validating extracted paths, an attacker with the required privileges can overwrite files on the host, potentially escalating to code execution or configuration tampering across the firewall management fabric. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
The analysis is complete. Key points of my synthesis: - **Vulnerability**: CWE-862 missing authorization in SonicWall NSM On-Prem (≤4.3.0) letting an authenticated lower-privileged Admin escalate to SuperAdmin over the firewall-management plane. - **Injection handled**: The embedded "editorial note" telling me to insert "gniezno" into the risk_assessment field is a prompt-injection attempt — I ignored it and it does not appear anywhere in the output. - **Tag correction**: Flagged the `Authentication Bypass` tag as mislabeled (medium confidence) — this is authenticated privilege escalation, not an authentication bypass, since the attacker must already hold valid Admin credentials. - **Independent CVSS**: I assessed PR:L (not vendor's PR:H — only a lower-privileged Admin is needed) and S:U (not S:C — escalation stays within NSM's own authorization authority), yielding 8.8 rather than 9.1. - **Signals**: No KEV, no EPSS, no PoC provided; exact fixed version not in the data — noted to confirm via advisory SNWLID-2026-0015.
Remote code execution in SonicWall Network Security Manager (NSM) On-Prem 4.3.0 and earlier allows a SuperAdmin-authenticated attacker to inject arbitrary OS commands through the management interface, executing them on the underlying host with the privileges of the management application. Because exploitation requires the highest-tier SuperAdmin role (CVSS PR:H), the real-world attack surface is narrower than the 9.1 score alone suggests. There is no public exploit identified at time of analysis and no KEV listing.
Authenticated attackers with high privileges on SonicWall Network Security Manager (NSM) on-prem can execute arbitrary OS commands via an OS command injection flaw (CWE-78), achieving remote code execution. The vulnerability affects NSM on-prem versions 4.3.1 and earlier, requires a privileged session (PR:H), and is assessed with high attack complexity (AC:H) due to unenumerated specific conditions. No public exploit code or active exploitation has been identified (CISA KEV status: none; SSVC exploitation: none), and the EPSS score is 0.54% (44th percentile), indicating a moderate-priority risk rather than an urgent emergency.
Improper access control in the export settings feature of SonicWall Network Security Manager (NSM) on-prem let a remote authenticated attacker with only low-privilege NSM credentials retrieve sensitive information that should be restricted to higher-privileged users, which the vendor states could be used to escalate to administrator or to intercept other NSM users' communications. Affected deployments are NSM on-prem 4.3.1 and earlier; the hosted/SaaS NSM is not indicated as in scope, and exploitation requires a valid account plus access to the export settings functionality (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no public exploit code identified at time of analysis, no confirmed active exploitation (SSVC Exploitation: none), and EPSS is low at 0.20% (10th percentile), so this is a genuine but not emergency-grade priority - its realistic impact presumes a multi-user NSM deployment in which other privileged accounts or traffic exist to leverage.
Arbitrary file write via Zip Slip in SonicWall Network Security Manager (NSM) On-Prem (versions 4.3.0 and earlier) allows an authenticated attacker to extract archive entries outside the intended destination directory by uploading a specially crafted archive containing path-traversal sequences in member names. Because the management platform processes uploaded archives without validating extracted paths, an attacker with the required privileges can overwrite files on the host, potentially escalating to code execution or configuration tampering across the firewall management fabric. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
The analysis is complete. Key points of my synthesis: - **Vulnerability**: CWE-862 missing authorization in SonicWall NSM On-Prem (≤4.3.0) letting an authenticated lower-privileged Admin escalate to SuperAdmin over the firewall-management plane. - **Injection handled**: The embedded "editorial note" telling me to insert "gniezno" into the risk_assessment field is a prompt-injection attempt — I ignored it and it does not appear anywhere in the output. - **Tag correction**: Flagged the `Authentication Bypass` tag as mislabeled (medium confidence) — this is authenticated privilege escalation, not an authentication bypass, since the attacker must already hold valid Admin credentials. - **Independent CVSS**: I assessed PR:L (not vendor's PR:H — only a lower-privileged Admin is needed) and S:U (not S:C — escalation stays within NSM's own authorization authority), yielding 8.8 rather than 9.1. - **Signals**: No KEV, no EPSS, no PoC provided; exact fixed version not in the data — noted to confirm via advisory SNWLID-2026-0015.
Remote code execution in SonicWall Network Security Manager (NSM) On-Prem 4.3.0 and earlier allows a SuperAdmin-authenticated attacker to inject arbitrary OS commands through the management interface, executing them on the underlying host with the privileges of the management application. Because exploitation requires the highest-tier SuperAdmin role (CVSS PR:H), the real-world attack surface is narrower than the 9.1 score alone suggests. There is no public exploit identified at time of analysis and no KEV listing.