Full Report
SonicWall has released security updates to address two security flaws impacting its Secure Mobile Access (SMA) 1000 series VPN appliances that have been exploited in zero-day attacks. The vulnerabilities, discovered internally by SonicWall's William Perry and Adam Babis, are listed below - CVE-2026-83548 (CVSS score: 10.0) - A pre-authentication SSRF vulnerability in the Appliance
Analysis Summary
# Vulnerability: SonicWall SMA 1000 Series Auth-Chain Zero-Days
## CVE Details
- **CVE ID:** CVE-2026-83548, CVE-2026-83549
- **CVSS Score:**
- **CVE-2026-83548:** 10.0 (Critical)
- **CVE-2026-83549:** 7.8 (High)
- **CWE:**
- **CVE-2026-83548:** SSRF (Server-Side Request Forgery)
- **CVE-2026-83549:** OS Command Injection
## Affected Systems
- **Products:** SonicWall Secure Mobile Access (SMA) 1000 series (Models: 6210, 7210, and 8200v).
- **Versions:**
- 12.4.3-03453 (platform-hotfix) and older
- 12.5.0-02835 (platform-hotfix) and older
- **Configurations:** Systems running the "Appliance Work Place" interface (for SSRF) and "Appliance Management Console (AMC)" (for Command Injection).
## Vulnerability Description
This advisory covers two vulnerabilities that are being chained together by attackers:
1. **CVE-2026-83548:** A pre-authentication SSRF vulnerability located in the Work Place interface. It allows a remote, unauthenticated attacker to access sensitive internal functionality and perform unauthorized operations.
2. **CVE-2026-83549:** A post-authentication OS command injection vulnerability in the Management Console (AMC). While it requires administrator authentication, it can be reached via the SSRF flaw, allowing an attacker to execute arbitrary commands at the OS level.
## Exploitation
- **Status:** Exploited in the wild (Zero-day).
- **Complexity:** Low (when chained).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** Critical (Full access to appliance data).
- **Integrity:** Critical (Ability to execute arbitrary commands/modify system).
- **Availability:** Critical (Total system compromise/RCE).
## Remediation
### Patches
SonicWall has released the following hotfix versions to address these flaws:
- **For 12.4.x:** Upgrade to **12.4.3-03526** (platform-hotfix).
- **For 12.5.x:** Upgrade to **12.5.0-02952** (platform-hotfix).
### Workarounds
No specific configuration workarounds were provided in the article; immediate patching is the primary recommendation.
## Detection
- **Indicators of Compromise:** Review system logs for unusual administrative activity or requests originating from the Work Place interface to the Management Console.
- **Incident Response:** If evidence of exploitation is found:
1. Re-image or re-deploy the affected appliance.
2. Rotate all user and administrator passwords.
3. Reset all Time-based One-Time Password (TOTP) keys.
## References
- **Vendor Advisory:** hxxps[://]psirt[.]global[.]sonicwall[.]com/vuln-detail/SNWLID-2026-0016
- **News Source:** hxxps[://]thehackernews[.]com/2026/09/attackers-exploit-two-sonicwall-sma.html