SMA1000 Pre-Auth SSRF and Post-Auth RCE/Vulnerability Advisory (CVE-2026-102255-58)

Vulnerability Overview Vulnerability ID: SNVUL-2026-0017 Publish Date: 2026-10-06 Last Update: 2026-10-06 Status: Applicable CVE Numbers: CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, CVE-2026-102258 CVSS v3 Score: 10.0 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Affected Scope Affected Products: SMA1000 Models - 6210, 7210, 8200v Affected Versions: - 12.4.3-03526 (platform-hotfix) and earlier - 12.5.0-02952 (platform-hotfix) and earlier Remediation Remediation Products: SMA1000 Models - 6210, 7210, 8200v Remediation Versions: - 12.4.3-03670 (platform-hotfix) and later - 12.5.0-03082 (platform-hotfix) and later Vulnerability Details 1. CVE-2026-102255 - Pre-authentication SSRF via unintended forward-proxy - Description: A pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unauthorized alternative access path. An attacker can leverage this vulnerability to send requests as a remote unauthenticated user, accessing internal functions and performing unauthorized operations. - CVSS Score: 10.0 - CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVE References: CVE-918, CVE-441, CVE-78, CVE-22, CVE-79 2. CVE-2026-102256 - Post-authentication Remote Code Execution (RCE) Vulnerability - Description: A post-authentication Remote Code Execution (RCE) vulnerability exists in the SMA1000 Appliance Management Console (AMC) interface. An attacker can leverage this vulnerability to execute arbitrary OS commands with administrative privileges. - CVSS Score: 7.8 - CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVE References: CVE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) 3. CVE-2026-102257 - Post-authentication Zip Slip Vulnerability - Description: A post-authentication Zip Slip vulnerability exists in the SMA1000 Appliance Management Console (AMC) interface. An attacker can leverage this vulnerability to extract files outside of the intended target directory. - CVSS Score: 7.2 - CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVE References: CVE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) 4. CVE-2026-102258 - Post-authentication Stored Cross-Site Scripting (XSS) Vulnerability - Description: A post-authentication stored Cross-Site Scripting (XSS) vulnerability exists in the SMA1000 Appliance Management Console (AMC) interface. An attacker can leverage this vulnerability to execute arbitrary JavaScript code with administrative privileges. - CVSS Score: 5.5 - CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVE References: CVE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Notes These vulnerabilities do not affect SonicWall firewalls running SSL-VPN or the SMA 100 product line. The latest platform-hotfixes are available for download at mysonicwall.com. Comments None Credits CVE-2026-102255: Benoit Sevens of Anthropic CVE-2026-102256: Benoit Sevens of Anthropic CVE-2026-102257: Brian Mariani via ZDI (Zero Day Initiative) Trend Micro - ZDI-CAN-28924 CVE-2026-102258: Brian Mariani - DigitalCanion SA Revision History Version: 1.0 Date: 06-Oct-2026 Description: Initial Release References None

Goal Reached Thanks to every supporter — we hit 100%!

SMA1000 Pre-Auth SSRF and Post-Auth RCE/Vulnerability Advisory (CVE-2026-102255-58)