cyber.hendryadrian.com
Vulnerability & Exploit · fieldeffect.com

SonicWall fixes critical unauthenticated SSRF flaw in SMA1000 appliances

· Original article ↗

Summary

SonicWall issued hotfixes for four SMA1000 vulnerabilities, including an unauthenticated SSRF flaw that can let remote attackers make appliances reach internal functionality. The company reported no evidence of exploitation.

Key points

  • CVE-2026-102255 is a pre-authentication SSRF flaw in the SMA1000 Appliance WorkPlace interface; exploitation requires network access to that interface.
  • Affected systems include SMA 6210, SMA 7210, and SMA 8200v appliances running platform hotfix 12.4.3-03526 or earlier, or 12.5.0-02952 or earlier.
  • SonicWall fixed the flaw in hotfixes 12.4.3-03670 and 12.5.0-03082. SMA 100 Series appliances and firewall SSL-VPN functionality are not affected.
  • SonicWall reported no evidence of exploitation and has not established that the flaw enables administrative access, appliance compromise, or remote code execution.
  • The update also fixes three authenticated flaws: command injection, Zip Slip path traversal, and stored cross-site scripting.
  • Public reporting identified more than 400 internet-exposed SMA1000 appliances at disclosure, but scanning could not determine which remained vulnerable.
  • SonicWall recommends upgrading, reviewing interface exposure, restricting appliance access and outbound connectivity, and monitoring appliance traffic and administrative activity.

Article Details

Vulnerability Types
  • Server-side request forgery (SSRF)
  • Operating system command injection
  • Path traversal (Zip Slip)
  • Stored cross-site scripting (XSS)
Severity
Maximum severity for CVE-2026-102255; severity for the other vulnerabilities is not stated.
Affected Versions
  • SMA 6210 running platform hotfix 12.4.3-03526 or earlier
  • SMA 7210 running platform hotfix 12.4.3-03526 or earlier
  • SMA 8200v running platform hotfix 12.4.3-03526 or earlier
  • SMA 6210 running platform hotfix 12.5.0-02952 or earlier
  • SMA 7210 running platform hotfix 12.5.0-02952 or earlier
  • SMA 8200v running platform hotfix 12.5.0-02952 or earlier
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Restrict Appliance WorkPlace access to authorized users and trusted networks.
  • Restrict outbound connectivity from SMA1000 appliances to services required for business operations and remote access workflows.
  • Segment remote access infrastructure from sensitive administrative systems.

CVE

CVE-2026-102255CVE-2026-102255 allows a remote, unauthenticated threat actor to make the appliance issue requests that can reach internal functionality.CVE-2026-102256CVE-2026-102256 is an operating system command injection vulnerability that SonicWall characterizes as remote code execution and requires an administrator account.CVE-2026-102257CVE-2026-102257 is a Zip Slip path traversal vulnerability in the Appliance Management Console that allows a specially crafted archive to place files outside the intended extraction directory and may lead to remote codeCVE-2026-102258CVE-2026-102258 is a stored cross-site scripting vulnerability in the Appliance Management Console that requires administrator access.

Vendors

SonicWallSonicWall released hotfixes on October 6, 2026, for four vulnerabilities affecting SMA1000 secure remote access appliances, including a maximum-severity flaw in the Appliance WorkPlace interface.

Products

Appliance Management ConsoleCVE-2026-102257 is a Zip Slip path traversal vulnerability in the Appliance Management Console that allows a specially crafted archive to place files outside the intended extraction directory and may lead to remote codeAppliance WorkPlaceSonicWall released hotfixes on October 6, 2026, for four vulnerabilities affecting SMA1000 secure remote access appliances, including a maximum-severity flaw in the Appliance WorkPlace interface.SMA 6210The affected products include the SMA 6210 and SMA 7210 hardware appliances and the SMA 8200v virtual appliance, all of which run the SMA1000 software platform.SMA 7210The affected products include the SMA 6210 and SMA 7210 hardware appliances and the SMA 8200v virtual appliance, all of which run the SMA1000 software platform.SMA 8200vThe affected products include the SMA 6210 and SMA 7210 hardware appliances and the SMA 8200v virtual appliance, all of which run the SMA1000 software platform.SMA1000SonicWall released hotfixes on October 6, 2026, for four vulnerabilities affecting SMA1000 secure remote access appliances, including a maximum-severity flaw in the Appliance WorkPlace interface.

Related Articles