SonicWall SMA1000 fixes 4 vulnerabilities

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] SonicWall SMA1000 fixes 4 vulnerabilities

SonicWall fixes 4 vulnerabilities in the SMA1000 product (models 6210, 7210 and 8200v). The fix is available as a platform-hotfix in versions 12.4.3-03670 and 12.5.0-03082 [1].

SonicWall SMA1000 - SSRF (CVE-2026-102255)

CVSS 10.0 (Critical)

An unauthenticated remote attacker can carry out an SSRF attack, access internal functionality and perform unauthorized operations, due to an unintended alternate access path in the Work Place interface [1].

The vulnerability is present in product:

SonicWall SMA1000; <12.4.3-03670; <12.5.0-03082

CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

CVE-2026-102255 at cve.org, NVD
CWE-918: Server-Side Request Forgery (SSRF) at cwe.mitre.org
CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') at cwe.mitre.org

The vulnerability was publicly disclosed 6. 10. 2026.

SonicWall SMA1000 - RCE (CVE-2026-102256)

CVSS 7.8 (High)

An authenticated attacker with administrator privileges can, under certain conditions, execute arbitrary operating system commands due to insufficient input sanitization [1].

The vulnerability is present in product:

SonicWall SMA1000; <12.4.3-03670; <12.5.0-03082

CVSS: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

CVE-2026-102256 at cve.org, NVD
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

SonicWall SMA1000 - RCE (CVE-2026-102257)

CVSS 7.2 (High)

An authenticated remote attacker can write files outside the designated directory and execute arbitrary code, due to insufficient restriction of the target path when extracting an archive in the Appliance Management Console [1].

The vulnerability is present in product:

SonicWall SMA1000; <12.4.3-03670; <12.5.0-03082

CVSS: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

CVE-2026-102257 at cve.org, NVD
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 6. 10. 2026.

SonicWall SMA1000 - XSS (CVE-2026-102258)

CVSS 5.5 (Medium)

An authenticated remote attacker with administrator privileges can, under certain conditions, carry out a stored XSS attack due to insufficient input sanitization in the Appliance Management Console [1].

The vulnerability is present in product:

SonicWall SMA1000; <12.4.3-03670; <12.5.0-03082

CVSS: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

More information:

CVE-2026-102258 at cve.org, NVD
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 6. 10. 2026.

Report feedback

[TLP:CLEAR] SonicWall SMA1000 fixes 4 vulnerabilities

SonicWall SMA1000 - SSRF (CVE-2026-102255)

CVSS 10.0 (Critical)

SonicWall SMA1000 - RCE (CVE-2026-102256)

CVSS 7.8 (High)

SonicWall SMA1000 - RCE (CVE-2026-102257)

CVSS 7.2 (High)

SonicWall SMA1000 - XSS (CVE-2026-102258)

CVSS 5.5 (Medium)

Links