Read the docs
TI-2026-57685 Aliases CVE-2026-83549GHSA-vxcc-7cf2-wcgh

OS command injection in SonicWall SMA1000

Priority CRITICAL 93Exploited in the wildCWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-78.

Summary

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

Why it matters now

Exploitation Active In CISA KEV since 2026-09-02CISA due date 2026-09-05
EPSS 0.09889 95th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SonicWallSMA100012.4.3-03453 (platform-hotfix) and older versions; 12.5.0-02835 (platform-hotfix) and older versions—No fix listedCNA
  • SMA1000 VendorSonicWall Affected 12.4.3-03453 (platform-hotfix) and older versions; 12.5.0-02835 (platform-hotfix) and older versions Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:sonicwall:sma8200v:*:*:*:*:*:*:*:*before 12.4.3-03526; 12.5.0 to before 12.5.0-02952VulnerableSonicWall
cpe:2.3:a:sonicwall:sma8200v:-:*:*:*:*:*:*:*not specified by NVDRunning onSonicWall
cpe:2.3:o:sonicwall:sma6210_firmware:*:*:*:*:*:*:*:*before 12.4.3-03526; 12.5.0 to before 12.5.0-02952VulnerableSonicWall
cpe:2.3:h:sonicwall:sma6210:-:*:*:*:*:*:*:*not specified by NVDRunning onSonicWall
cpe:2.3:o:sonicwall:sma7210_firmware:*:*:*:*:*:*:*:*before 12.4.3-03526; 12.5.0 to before 12.5.0-02952VulnerableSonicWall
cpe:2.3:h:sonicwall:sma7210:-:*:*:*:*:*:*:*not specified by NVDRunning onSonicWall
  • cpe:2.3:a:sonicwall:sma8200v:*:*:*:*:*:*:*:* Versions before 12.4.3-03526; 12.5.0 to before 12.5.0-02952 Vulnerable ·SonicWall
  • cpe:2.3:a:sonicwall:sma8200v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SonicWall
  • cpe:2.3:o:sonicwall:sma6210_firmware:*:*:*:*:*:*:*:* Versions before 12.4.3-03526; 12.5.0 to before 12.5.0-02952 Vulnerable ·SonicWall
  • cpe:2.3:h:sonicwall:sma6210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SonicWall
  • cpe:2.3:o:sonicwall:sma7210_firmware:*:*:*:*:*:*:*:* Versions before 12.4.3-03526; 12.5.0 to before 12.5.0-02952 Vulnerable ·SonicWall
  • cpe:2.3:h:sonicwall:sma7210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SonicWall

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    SonicWall SMA1000 — psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016

    2 records Highest priority Priority CRITICAL 2 CRITICAL

    Other records, highest priority first

    • TI-2026-57684 Server-side request forgery in SonicWall SMA1000Priority CRITICAL 100
    Show all 2 records → Advisory →

Timeline

  1. 2026-09-02 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2026-83549
  3. 2026-10-03 Alias added: GHSA-vxcc-7cf2-wcgh

References

Advisory 1

  • TI-2026-57684 Server-side request forgery in SonicWall SMA1000 KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-12965 Server-side request forgery in SonicWall SMA1000 KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-16819 Deserialization of untrusted data in SonicWall SMA1000 KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-12966 Code injection in SonicWall SMA1000 KEVCVSS 3.1HIGH 7.2
  • TI-2025-27082 Missing authorization in SonicWall SMA1000 KEVCVSS 3.1MEDIUM 6.6
  • TI-2026-03562 SQL injection in SonicWall SMA1000 CVSS 3.1HIGH 7.2
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences