{"id":233,"created_when":"2026-11-10T08:57:49Z","created_by":"arun","updated_when":"2026-11-10T08:57:49Z","updated_by":"arun","advisory_id":"SNWLID-2026-0021","title":"Informational Advisory: SonicOS Client DPI-SSL Trust of Compromised eMudhra Certificate Chain","published_when":"2026-11-10T08:57:49Z","last_updated_when":"2026-11-10T08:57:49Z","impact":"not_defined","cvss":null,"cvss_vector":null,"cvss_version":3.0,"cwe":null,"cve":null,"cpe":"","summary":"

SonicWall has addressed an issue in SonicOS where appliances with Client DPI-SSL enabled continued to trust certificate chains issued by compromised eMudhra intermediate Certificate Authorities (CAs). Because the firewall’s local certificate store trusted the underlying root certificates, the firewall re-signed traffic from impacted servers with the local SonicWall DPI-SSL CA certificate, preventing client browsers from rejecting connections signed by the untrusted intermediate CAs.

\r\nSonicWall has remediated this issue by removing the affected root certificates from the SonicOS certificate store and implementing blocking logic for the compromised intermediate certificate chain. SonicWall strongly recommends that customers upgrade to the latest release versions listed below to address and mitigate the associated risks.

","is_workaround_available":false,"workaround":"None.","detail":"","affected_products":"

Affected Platforms

Affected Versions


Gen7 Hardware Firewalls - TZ 270, TZ 270W, TZ 370, TZ 370W, TZ 470, TZ 470W, TZ 570, TZ 570W, TZ 570P, TZ 670,

NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, 

NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700

Gen7 NSv - NSv 270, NSv 470, NSv 870 (ESX, KVM, HYPER-V, AWS, Azure)




7.3.4-7013 and older versions.


Gen8 Hardware Firewalls - TZ 80, TZ 280, TZ 280W, TZ 380, TZ 380W, TZ 480, TZ 580, TZ 680,

NSa 2800, NSa 3800, NSa 4800, NSa 5800

Gen8 NSv - NSv XS, NSv S, NSv M, NSv L (ESX, KVM, HYPER-V, AWS, Azure)



8.2.2-8015 and older versions


","fixed_software":"

Fixed Platforms

Fixed Versions


Gen7 Hardware Firewalls - TZ 270, TZ 270W, TZ 370, TZ 370W, TZ 470, TZ 470W, TZ 570, TZ 570W, TZ 570P, TZ 670,

NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, 

NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700

Gen7 NSv - NSv 270, NSv 470, NSv 870 (ESX, KVM, HYPER-V, AWS, Azure)



7.3.4-7015 and higher versions


Gen8 Hardware Firewalls - TZ 80, TZ 280, TZ 280W, TZ 380, TZ 380W, TZ 480, TZ 580, TZ 680,

NSa 2800, NSa 3800, NSa 4800, NSa 5800

Gen8 NSv - NSv XS, NSv S, NSv M, NSv L (ESX, KVM, HYPER-V, AWS, Azure)



8.2.3-8015 and higher versions

","credits":"","revision_history":"\r\n\r\n","references":"","vuln_status":"Applicable","status":"published","is_published":true,"patterns":[],"vulnerable_products":[{"id":3,"name":"SonicOS Gen7 Platform - TZ/NSa/NSsp/NSv"},{"id":32,"name":"SonicOS Gen8 Platform - TZ/NSa"}]}