{"id":227,"created_when":"2026-09-01T05:43:57Z","created_by":"arun","updated_when":"2026-09-01T05:43:57Z","updated_by":"arun","advisory_id":"SNWLID-2026-0016","title":"SonicWall SMA1000 Series Appliances Affected By Multiple Vulnerabilities","published_when":"2026-09-01T05:43:57Z","last_updated_when":"2026-09-01T05:43:57Z","impact":"critical","cvss":"10.0","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-918, CWE-441, CWE-78","cve":"CVE-2026-83548, CVE-2026-83549","cpe":"","summary":"

\r\n\r\n

1) CVE-2026-83548 - Pre-authentication SSRF via unintended forward-proxy

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations..\r\n

CVSS Score: 10.0
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
\r\nCWE-918: Server-Side Request Forgery (SSRF)
\r\nCWE-441: Unintended Proxy or Intermediary ('Confused Deputy')\r\n\r\n

\r\n\r\n

2) CVE-2026-83549 - Post-authentication Remote Code Execution (RCE) Vulnerability

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.\r\n

CVSS Score: 7.8
\r\nCVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
\t\r\nCWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\r\n

\r\n\r\n

\r\n\r\n

IMPORTANT: SonicWall PSIRT has investigated a case indicating the active exploitation of the vulnerabilities described in this advisory. Customers are strongly urged to upgrade to the hotfix release as soon as possible to remediate this vulnerability.

","is_workaround_available":false,"workaround":"None.","detail":"

IMPORTANT: Recommended Actions

All organizations with deployments of SMA1000 appliances (whether virtual or physical) on affected versions must perform the following:

","affected_products":"

Affected Product

Affected Version(s)

SMA1000 Models - 6210, 7210, 8200v 

12.4.3-03453 (platform-hotfix) and older versions.

 12.5.0-02835 (platform-hotfix) and older versions. 


Note: These vulnerabilities do not affect SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line.

\r\n\r\nThe latest platform-hotfix is available for download on mysonicwall.com","fixed_software":"

Fixed Product

Fixed Version(s)

SMA1000 Models - 6210, 7210, 8200v

12.4.3-03526 (platform-hotfix) and higher versions.

12.5.0-02952 (platform-hotfix) and higher versions.


","credits":"

Internally discovered by William Perry and Adam Babis of SonicWall.

","revision_history":"\r\n\r\n","references":"","vuln_status":"Applicable","status":"published","is_published":true,"patterns":[{"id":5,"name":"Secure Mobile Access (SMA) 1000 Series","pattern":"^(?:12\\.4\\.[0-2]-\\d{1,5}|12\\.4\\.3-(?=\\d{1,5}$)0*(?:\\d{1,3}|[12]\\d{3}|3[0-3]\\d{2}|34[0-4]\\d|345[0-3])|12\\.5\\.0-(?=\\d{1,5}$)0*(?:\\d{1,3}|1\\d{3}|2[0-7]\\d{2}|28[0-2]\\d|283[0-5]))$"}],"vulnerable_products":[{"id":5,"name":"Secure Mobile Access (SMA) 1000 Series"}]}