This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] SonicWall SMA1000 (models 6210, 7210 and 8200v) fix 2 actively exploited vulnerabilities
SonicWall fixes 2 chainable vulnerabilities in the SMA1000 product (models 6210, 7210 and 8200v) in versions 12.4.3-03453 and 12.5.0-02835 [1][2]. SonicWall is aware of active exploitation of the vulnerabilities, and CISA has added the vulnerabilities to its list of actively exploited vulnerabilities [1][3]. SonicWall has also published IoCs that can be searched for in logs [1].
An unauthenticated remote attacker can carry out an SSRF attack [1]. The vulnerability can be chained with other vulnerabilities (including CVE-2026-15410) to gain control of the affected machine with root privileges [2].
The vulnerability is present in product:
- SMA1000 Models - 6210, 7210, 8200v; ==12.4.3-03245; ==12.4.3-03387; ==12.4.3-03434;
CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2026-15409 at cve.org, NVD
- CWE-918: Server-Side Request Forgery (SSRF) at cwe.mitre.org
The vulnerability was publicly disclosed 14. 7. 2026.
An authenticated remote attacker with administrator privileges can execute arbitrary commands in the operating system of the affected device [1].
The vulnerability is present in product:
- SMA1000 Models - 6210, 7210, 8200v; ==12.4.3-03245; ==12.4.3-03387; ==12.4.3-03434;
CVSS: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-15410 at cve.org, NVD
- CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 14. 7. 2026.
Links
By CESNET, z.s.p.o. Martin Krajči on 17. 7. 2026.