MDR
Solutions
Partners
About
Resources
Affected Environment
SonicWall SMA1000 models 6210, 7210, and 8200v running 12.4.3-03526 or 12.5.0-02952 platform-hotfix and older. SMA 100 unaffected.
Threat Overview
Four vulnerabilities enable SSRF, OS command injection, Zip Slip remote code execution, and stored cross-site scripting on SMA1000 appliances.
Exposure Timeline
Issued 6 October 2026. Fixed hotfixes 12.4.3-03670 and 12.5.0-03082 are available; exploitation is not confirmed in the report.
Attack Surface
Pre-authentication Work Place interface and post-authentication Appliance Management Console (AMC) on SMA1000 appliances.
Technical Root Cause
Unintended alternate access path enabling SSRF, OS command neutralization failure, unsafe archive extraction, and unsanitized stored script input.
Exploitation Pathway
Attacker abuses the forward-proxy path to reach internal functions; authenticated attackers use crafted archives or commands for code execution.
Operational Impact
Unauthorized internal requests, arbitrary OS command execution, remote code execution, and script execution inside the Appliance Management Console.
Strategic Impact
Critical for large and medium government and business entities, high for small ones. Compromised remote access appliances expose internal networks.
Required Mitigation
Upgrade to 12.4.3-03670 or 12.5.0-03082 platform-hotfix or later after testing. Filter network traffic to management interfaces.
Incident Response Guidance
Review Work Place and AMC access logs for unusual requests, unexpected archive uploads, and administrator activity. Scan externally exposed assets.
References
SonicWall PSIRT Advisory SNWLID-2026-0017; CVE-2026-102255 to CVE-2026-102258.
Trusted by clients worldwide
Led by human expertise and powered by the VisionX platform, we provide you with a 24/7 unbeatable Managed Detection & Response capability giving you transparent and consolidated security solutions.
.jpg)