CVE-2026-102255: SSRF
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is pre-authentication and can be exploited by a remote attacker without valid credentials or user interaction.
Which deployments are exposed?
SonicWall SMA 1000 Appliance deployments with the Work Place interface reachable by a remote attacker are exposed to the described attack path.
What could an attacker do after successful exploitation?
An attacker could cause the appliance to make requests on their behalf, potentially reach internal functionality, and perform unauthorized operations.