Sma1000
Monthly
Remote code execution in SonicWall SMA1000 (Appliance Management Console) can be triggered by an authenticated administrator who uploads a crafted archive containing path traversal sequences, allowing files to be written outside the intended extraction directory and leading to code execution. The vulnerability is a classic Zip Slip (CWE-22) issue with a CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker must already hold high/administrative privileges on the AMC-a significant precondition that sharply limits the pool of realistic attackers to compromised or malicious administrators. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none), so this is a conditional high-severity risk rather than a mass-exploitation emergency.
OS command injection in the SonicWall SMA1000 Appliance Management Console (AMC) allows a remote authenticated administrator to execute arbitrary OS commands under specific conditions, achieving full remote code execution on the appliance. The vulnerability (CWE-78) is post-authentication and gated by administrator-level credentials, narrowing the exploitable attack surface to compromised or malicious admin accounts. No public exploit code or active exploitation has been identified at time of analysis, though SMA1000 appliances are high-value targets as network edge remote-access devices.
Pre-authentication server-side request forgery in the SonicWall SMA1000 secure-access appliance's Work Place interface lets a remote unauthenticated attacker abuse an unintended alternate access path to reach internal/sensitive functionality and perform unauthorized operations. It affects SMA1000 firmware up to and including 12.4.3-03453 and 12.5.0-02835 (platform-hotfix builds and older), carries a maximal CVSS of 10.0, and has publicly available exploit code. SonicWall SMA appliances have been a repeated target of real-world attacks, and reporting ties this to broader SMA exploitation activity, though CISA KEV listing is not confirmed in the provided data.
Post-authentication OS command execution in the SonicWall SMA1000 Appliance Management Console (AMC) allows a remote attacker holding administrator credentials to inject and run arbitrary operating-system commands on the appliance under specific conditions. It affects SMA1000 firmware branches 12.4.3 and 12.5.0, is confirmed actively exploited (CISA KEV), and has publicly available exploit code, though the EPSS probability sits at a moderate 1.65% (74th percentile), consistent with targeted rather than mass exploitation. Successful abuse yields total control of the management plane of an internet-facing remote-access appliance.
Server-side request forgery in the SonicWall SMA1000 Appliance Work Place interface lets remote, unauthenticated attackers (PR:N) coerce the appliance into issuing attacker-controlled requests to unintended internal or external destinations. It is confirmed actively exploited (CISA KEV), publicly available exploit code exists, and it carries a maximal CVSS 10.0 with a scope change, making internet-facing SMA1000 appliances a high-priority patch. EPSS is modest at 1.40% (69th percentile), which alongside KEV points to targeted rather than mass-scanning exploitation so far.
Stored cross-site scripting in the SonicWall SMA1000 Appliance Management Console (AMC) allows an attacker who already holds administrator credentials to persist arbitrary JavaScript that then executes in the browser session of another privileged AMC user under the vendor's stated 'specific conditions.' The flaw affects SMA1000 12.4.3-03526 (platform-hotfix) and 12.5.0-02952 (platform-hotfix) along with all older builds, and is rated moderate severity at CVSS 6.1 with low confidentiality/integrity impact and no availability impact. The only hard gate is authentication: an independent assessment places the requirement at PR:H, meaning the attacker must already be an AMC administrator, and exploitation also requires a victim to view the poisoned page (UI:R). No public exploit code has been identified, CISA's SSVC framework records exploitation as none and automation as not feasible, and the available signals converge on LOW real-world priority rather than an urgent threat.
Remote code execution in SonicWall SMA1000 (Appliance Management Console) can be triggered by an authenticated administrator who uploads a crafted archive containing path traversal sequences, allowing files to be written outside the intended extraction directory and leading to code execution. The vulnerability is a classic Zip Slip (CWE-22) issue with a CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker must already hold high/administrative privileges on the AMC-a significant precondition that sharply limits the pool of realistic attackers to compromised or malicious administrators. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none), so this is a conditional high-severity risk rather than a mass-exploitation emergency.
OS command injection in the SonicWall SMA1000 Appliance Management Console (AMC) allows a remote authenticated administrator to execute arbitrary OS commands under specific conditions, achieving full remote code execution on the appliance. The vulnerability (CWE-78) is post-authentication and gated by administrator-level credentials, narrowing the exploitable attack surface to compromised or malicious admin accounts. No public exploit code or active exploitation has been identified at time of analysis, though SMA1000 appliances are high-value targets as network edge remote-access devices.
Pre-authentication server-side request forgery in the SonicWall SMA1000 secure-access appliance's Work Place interface lets a remote unauthenticated attacker abuse an unintended alternate access path to reach internal/sensitive functionality and perform unauthorized operations. It affects SMA1000 firmware up to and including 12.4.3-03453 and 12.5.0-02835 (platform-hotfix builds and older), carries a maximal CVSS of 10.0, and has publicly available exploit code. SonicWall SMA appliances have been a repeated target of real-world attacks, and reporting ties this to broader SMA exploitation activity, though CISA KEV listing is not confirmed in the provided data.
Post-authentication OS command execution in the SonicWall SMA1000 Appliance Management Console (AMC) allows a remote attacker holding administrator credentials to inject and run arbitrary operating-system commands on the appliance under specific conditions. It affects SMA1000 firmware branches 12.4.3 and 12.5.0, is confirmed actively exploited (CISA KEV), and has publicly available exploit code, though the EPSS probability sits at a moderate 1.65% (74th percentile), consistent with targeted rather than mass exploitation. Successful abuse yields total control of the management plane of an internet-facing remote-access appliance.
Server-side request forgery in the SonicWall SMA1000 Appliance Work Place interface lets remote, unauthenticated attackers (PR:N) coerce the appliance into issuing attacker-controlled requests to unintended internal or external destinations. It is confirmed actively exploited (CISA KEV), publicly available exploit code exists, and it carries a maximal CVSS 10.0 with a scope change, making internet-facing SMA1000 appliances a high-priority patch. EPSS is modest at 1.40% (69th percentile), which alongside KEV points to targeted rather than mass-scanning exploitation so far.
Stored cross-site scripting in the SonicWall SMA1000 Appliance Management Console (AMC) allows an attacker who already holds administrator credentials to persist arbitrary JavaScript that then executes in the browser session of another privileged AMC user under the vendor's stated 'specific conditions.' The flaw affects SMA1000 12.4.3-03526 (platform-hotfix) and 12.5.0-02952 (platform-hotfix) along with all older builds, and is rated moderate severity at CVSS 6.1 with low confidentiality/integrity impact and no availability impact. The only hard gate is authentication: an independent assessment places the requirement at PR:H, meaning the attacker must already be an AMC administrator, and exploitation also requires a victim to view the poisoned page (UI:R). No public exploit code has been identified, CISA's SSVC framework records exploitation as none and automation as not feasible, and the available signals converge on LOW real-world priority rather than an urgent threat.