SonicWall SMA1000: Vulnerability with highest rating opens internal functions

SonicWall has released updates for its SMA1000 appliances, patching some critical security vulnerabilities. One security flaw allows unauthorized network access without prior login, while another allows the injection and execution of malicious code.

This is warned by SonicWall in a security advisory . The developers rate a server-side request forgery (SSRF) in the Work-Place interface as the most severe. Via an unintended alternative access path, an unwanted forward proxy, malicious actors from the network can trick the SMA1000 appliance into accessing internal functions on their behalf without prior authentication and executing unauthorized actions. The severity suggests that attackers could exploit the vulnerability for complete appliance compromise or persistent network access; SonicWall does not provide further details on the specific possible impacts (CVE-2026-102255, CVSS 10.0 , Risk “ critical ”).

Furthermore, the appliances have a command injection vulnerability that allows attackers logged in as admin from the network to inject and execute arbitrary code (CVE-2026-102256, CVSS 7.8 , Risk “ high ”). With manipulated ZIP files, attackers logged in as admin can trigger a vulnerability during extraction, causing files to be extracted outside the intended target paths, thus enabling the injection of malicious code (CVE-2026-102257, CVSS 7.2 , Risk “ high ”). Finally, the appliance management console contains a stored cross-site scripting vulnerability that allows attackers logged in as admin to inject JavaScript code (CVE-2026-102258, CVSS 5.5 , Risk “ medium ”).

Versions 12.4.3-03670 and 12.5.0-03082 or newer firmware for SMA1000 models 6210, 7210, and 8200v correct the security-relevant errors, as SonicWall states. Currently, there are also no indications that these vulnerabilities are being exploited in the wild. Nevertheless, IT managers should not hesitate and apply the updates as quickly as possible.

Most recently, at the beginning of September this year, SonicWall patched critical vulnerabilities in the SMA1000 appliances . There, too, an SSRF vulnerability allowed unauthorized access to services without prior login, enabling attackers to gain persistent access, for example. Attackers were already actively exploiting the vulnerability. The new SSRF vulnerability again affects the Work-Place interface; whether it is a variant or a bypass of the fix at that time is left open by SonicWall.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.