{"id":12136,"date":"2026-10-08T21:32:35","date_gmt":"2026-10-09T03:32:35","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-113-critical-ssrf-vulnerability-in-sonicwall-sma1000\/"},"modified":"2026-10-08T21:54:20","modified_gmt":"2026-10-09T03:54:20","slug":"alert-2026-113-critical-ssrf-vulnerability-in-sonicwall-sma1000","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-113-critical-ssrf-vulnerability-in-sonicwall-sma1000\/","title":{"rendered":"Alert 2026-113 Critical SSRF Vulnerability in SonicWall SMA1000"},"content":{"rendered":"\n

Affected product(s):<\/h2>\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td>Fixed version<\/strong><\/td><\/tr>
SonicWall SMA1000: models 6210, 7210 and 8200v, branch 12.4.3<\/strong><\/td>12.4.3-03526 (platform-hotfix) and earlier<\/td>12.4.3-03670 (platform-hotfix) or later of the corresponding branch<\/td><\/tr>
SonicWall SMA1000: models 6210, 7210 and 8200v, branch 12.5.0<\/strong><\/td>12.5.0-02952 (platform-hotfix) and earlier<\/td>12.5.0-03082 (platform-hotfix) or later of the corresponding branch<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Description<\/h2>\n\n

A server-side request forgery vulnerability identified as CVE-2026-102255 CVSSv3 10 (critical), known as SSRF, was identified in the WorkPlace interface of its Secure Mobile Access (SMA) 1000 series devices. The flaw allows a remote, unauthenticated attacker to force the device to make requests on their behalf, reach internal functionalities, and execute unauthorized operations.<\/p>\n\n

CVE-2026-102255 originates in an unanticipated access side channel within the WorkPlace interface. An attacker can leverage it to induce the appliance to issue requests toward internal functionalities and perform operations that should not be available without authorization. Exploitation is remote, does not require credentials, and presents low complexity.<\/p>\n\n

The vulnerability affects SMA models 6210, 7210, and 8200v. It does not affect the SMA 100 series or the SSL-VPN functionality of SonicWall firewalls. The vendor released the hotfixes on October 6, 2026.<\/p>\n\n

Within the security bulletin published about the mentioned vulnerability and update, other vulnerabilities are also fixed:<\/p>\n\n

CVE<\/strong><\/td>Vulnerability<\/strong><\/td>CVSS<\/strong><\/td><\/tr>
CVE-2026-102256<\/strong><\/td>Operating system command injection<\/td>7.8<\/td><\/tr>
CVE-2026-102257<\/strong><\/td>Zip Slip path traversal<\/td>7.2<\/td><\/tr>
CVE-2026-102258<\/strong><\/td>Stored cross-site scripting<\/td>5.5<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Solution<\/h2>\n\n

The vendor has released a hotfix; it is recommended to update to 12.4.3-03670<\/code> or 12.5.0-03082<\/code>, or to a later fixed version of the applicable branch. The packages are available through MySonicWall.<\/p>\n\n

https:\/\/www.mysonicwall.com<\/a><\/p>\n\n

Additional information:<\/h2>\n\n