Vulnerability-Lookup

WID-SEC-W-2026-3757

Vulnerability from csaf_certbund - Published: 2026-10-06 22:00 - Updated: 2026-10-12 22:00

Summary

SonicWall SMA1000: Mehrere Schwachstellen

Severity

Kritisch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: SonicWall SMA ist ein Secure Access Gateway, mit dem Organisationen Zugang zu geschäftskritischen Unternehmensressourcen bereitstellen können.

Angriff: Ein Angreifer kann mehrere Schwachstellen in SonicWall SMA1000 ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren oder offenzulegen, beliebigen Code auszuführen und Cross-Site-Scripting-Angriffe durchzuführen.

Betroffene Betriebssysteme: - Appliance - Sonstiges

CVE-2026-102255

Affected products

Known affected 6 products

Product	Identifier	Version	Remediation
SonicWall SMA 1000 Models 7210 <12.4.3-03670 SonicWall / SMA		1000 Models 7210 <12.4.3-03670
SonicWall SMA 1000 Models 6210 <12.5.0-03082 SonicWall / SMA		1000 Models 6210 <12.5.0-03082
SonicWall SMA 1000 Models 6210 <12.4.3-03670 SonicWall / SMA		1000 Models 6210 <12.4.3-03670
SonicWall SMA 1000 Models 8200v <12.5.0-03082 SonicWall / SMA		1000 Models 8200v <12.5.0-03082
SonicWall SMA 1000 Models 8200v <12.4.3-03670 SonicWall / SMA		1000 Models 8200v <12.4.3-03670
SonicWall SMA 1000 Models 7210 <12.5.0-03082 SonicWall / SMA		1000 Models 7210 <12.5.0-03082

CVE-2026-102256

Affected products

Known affected 6 products, the same list as for CVE-2026-102255

CVE-2026-102257

Affected products

Known affected 6 products, the same list as for CVE-2026-102255

CVE-2026-102258

Affected products

Known affected 6 products, the same list as for CVE-2026-102255

References

4 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://psirt.global.sonicwall.com/vuln-detail/SN…	external
https://previdian.com/CVE-2026-102255	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "kritisch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "SonicWall SMA ist ein Secure Access Gateway, mit dem Organisationen Zugang zu gesch\u00e4ftskritischen Unternehmensressourcen bereitstellen k\u00f6nnen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in SonicWall SMA1000 ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren oder offenzulegen, beliebigen Code auszuf\u00fchren und Cross-Site-Scripting-Angriffe durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Appliance\n- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-3757 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3757.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-3757 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3757"
      },
      {
        "category": "external",
        "summary": "SonicWall Security Advisory SNWLID-2026-0017 vom 2026-10-06",
        "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017"
      },
      {
        "category": "external",
        "summary": "CVE-2026-102255 Exploitation Observed vom 2026-10-12",
        "url": "https://previdian.com/CVE-2026-102255"
      }
    ],
    "source_lang": "en-US",
    "title": "SonicWall SMA1000: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-10-12T22:00:00.000+00:00",
      "generator": {
        "date": "2026-10-13T04:59:16.140+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-3757",
      "initial_release_date": "2026-10-06T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-10-06T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-10-07T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-94325, EUVD-2026-94324, EUVD-2026-94327, EUVD-2026-94326"
        },
        {
          "date": "2026-10-12T22:00:00.000+00:00",
          "number": "3",
          "summary": "CVE-2026-102255 wird ausgenutzt"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "1000 Models 6210 \u003c12.4.3-03670",
                "product": {
                  "name": "SonicWall SMA 1000 Models 6210 \u003c12.4.3-03670",
                  "product_id": "T060692"
                }
              },
              {
                "category": "product_version",
                "name": "1000 Models 6210 12.4.3-03670",
                "product": {
                  "name": "SonicWall SMA 1000 Models 6210 12.4.3-03670",
                  "product_id": "T060692-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:sonicwall:secure_mobile_access:1000_models_6210__12.4.3-03670"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "1000 Models 6210 \u003c12.5.0-03082",
                "product": {
                  "name": "SonicWall SMA 1000 Models 6210 \u003c12.5.0-03082",
                  "product_id": "T060693"
                }
              },
              {
                "category": "product_version",
                "name": "1000 Models 6210 12.5.0-03082",
                "product": {
                  "name": "SonicWall SMA 1000 Models 6210 12.5.0-03082",
                  "product_id": "T060693-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:sonicwall:secure_mobile_access:1000_models_6210__12.5.0-03082"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "1000 Models 7210 \u003c12.4.3-03670",
                "product": {
                  "name": "SonicWall SMA 1000 Models 7210 \u003c12.4.3-03670",
                  "product_id": "T060694"
                }
              },
              {
                "category": "product_version",
                "name": "1000 Models 7210 12.4.3-03670",
                "product": {
                  "name": "SonicWall SMA 1000 Models 7210 12.4.3-03670",
                  "product_id": "T060694-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:sonicwall:secure_mobile_access:1000_models_7210__12.4.3-03670"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "1000 Models 7210 \u003c12.5.0-03082",
                "product": {
                  "name": "SonicWall SMA 1000 Models 7210 \u003c12.5.0-03082",
                  "product_id": "T060695"
                }
              },
              {
                "category": "product_version",
                "name": "1000 Models 7210 12.5.0-03082",
                "product": {
                  "name": "SonicWall SMA 1000 Models 7210 12.5.0-03082",
                  "product_id": "T060695-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:sonicwall:secure_mobile_access:1000_models_7210__12.5.0-03082"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "1000 Models 8200v \u003c12.4.3-03670",
                "product": {
                  "name": "SonicWall SMA 1000 Models 8200v \u003c12.4.3-03670",
                  "product_id": "T060696"
                }
              },
              {
                "category": "product_version",
                "name": "1000 Models 8200v 12.4.3-03670",
                "product": {
                  "name": "SonicWall SMA 1000 Models 8200v 12.4.3-03670",
                  "product_id": "T060696-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:sonicwall:secure_mobile_access:1000_models_8200v__12.4.3-03670"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "1000 Models 8200v \u003c12.5.0-03082",
                "product": {
                  "name": "SonicWall SMA 1000 Models 8200v \u003c12.5.0-03082",
                  "product_id": "T060697"
                }
              },
              {
                "category": "product_version",
                "name": "1000 Models 8200v 12.5.0-03082",
                "product": {
                  "name": "SonicWall SMA 1000 Models 8200v 12.5.0-03082",
                  "product_id": "T060697-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:sonicwall:secure_mobile_access:1000_models_8200v__12.5.0-03082"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SMA"
          }
        ],
        "category": "vendor",
        "name": "SonicWall"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-102255",
      "product_status": {
        "known_affected": [
          "T060694",
          "T060693",
          "T060692",
          "T060697",
          "T060696",
          "T060695"
        ]
      },
      "release_date": "2026-10-06T22:00:00.000+00:00",
      "title": "CVE-2026-102255"
    },
    {
      "cve": "CVE-2026-102256",
      "product_status": {
        "known_affected": [
          "T060694",
          "T060693",
          "T060692",
          "T060697",
          "T060696",
          "T060695"
        ]
      },
      "release_date": "2026-10-06T22:00:00.000+00:00",
      "title": "CVE-2026-102256"
    },
    {
      "cve": "CVE-2026-102257",
      "product_status": {
        "known_affected": [
          "T060694",
          "T060693",
          "T060692",
          "T060697",
          "T060696",
          "T060695"
        ]
      },
      "release_date": "2026-10-06T22:00:00.000+00:00",
      "title": "CVE-2026-102257"
    },
    {
      "cve": "CVE-2026-102258",
      "product_status": {
        "known_affected": [
          "T060694",
          "T060693",
          "T060692",
          "T060697",
          "T060696",
          "T060695"
        ]
      },
      "release_date": "2026-10-06T22:00:00.000+00:00",
      "title": "CVE-2026-102258"
    }
  ]
}

CVE-2026-102255 (GCVE-0-2026-102255)

Vulnerability from cvelistv5 – Published: 2026-10-07 13:07 – Updated: 2026-10-07 15:51

Summary

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 15:50 UTC

CWE

CWE-918 - Server-Side request forgery (SSRF)
CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

Assigner

sonicwall mitre root Scorecard

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	SMA1000	Affected: 12.4.3-03526 (platform-hotfix) and older versions Affected: 12.5.0-02952 (platform-hotfix) and older versions

Date Public

2026-10-07 13:01

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 10,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-102255",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T15:50:57.013778Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T15:51:00.007Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "SMA1000",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "12.4.3-03526 (platform-hotfix) and older versions"
            },
            {
              "status": "affected",
              "version": "12.5.0-02952 (platform-hotfix) and older versions"
            }
          ]
        }
      ],
      "datePublic": "2026-10-07T13:01:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations."
            }
          ],
          "value": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side request forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-441",
              "description": "CWE-441 Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T13:07:13.384Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0017",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-102255",
    "datePublished": "2026-10-07T13:07:13.384Z",
    "dateReserved": "2026-09-28T19:39:42.850Z",
    "dateUpdated": "2026-10-07T15:51:00.007Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102256 (GCVE-0-2026-102256)

Vulnerability from cvelistv5 – Published: 2026-10-07 13:09 – Updated: 2026-10-08 03:55

Summary

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 00:00 UTC

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')

Assigner

sonicwall mitre root Scorecard

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	SMA1000	Affected: 12.4.3-03526 (platform-hotfix) and older versions Affected: 12.5.0-02952 (platform-hotfix) and older versions

Date Public

2026-10-07 13:01

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-102256",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T03:55:25.618Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "SMA1000",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "12.4.3-03526 (platform-hotfix) and older versions"
            },
            {
              "status": "affected",
              "version": "12.5.0-02952 (platform-hotfix) and older versions"
            }
          ]
        }
      ],
      "datePublic": "2026-10-07T13:01:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Post-authentication Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution."
            }
          ],
          "value": "Post-authentication Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T13:09:04.342Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0017",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-102256",
    "datePublished": "2026-10-07T13:09:04.342Z",
    "dateReserved": "2026-09-28T19:39:42.850Z",
    "dateUpdated": "2026-10-08T03:55:25.618Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102257 (GCVE-0-2026-102257)

Vulnerability from cvelistv5 – Published: 2026-10-07 13:12 – Updated: 2026-10-08 03:55

Summary

A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 00:00 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

sonicwall mitre root Scorecard

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	SMA1000	Affected: 12.4.3-03526 (platform-hotfix) and older versions Affected: 12.5.0-02952 (platform-hotfix) and older versions

Date Public

2026-10-07 13:01

Credits

Brian Mariani

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-102257",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T03:55:24.797Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "SMA1000",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "12.4.3-03526 (platform-hotfix) and older versions"
            },
            {
              "status": "affected",
              "version": "12.5.0-02952 (platform-hotfix) and older versions"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brian Mariani"
        }
      ],
      "datePublic": "2026-10-07T13:01:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution."
            }
          ],
          "value": "A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T13:12:25.319Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0017",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-102257",
    "datePublished": "2026-10-07T13:12:25.319Z",
    "dateReserved": "2026-09-28T19:39:42.850Z",
    "dateUpdated": "2026-10-08T03:55:24.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102258 (GCVE-0-2026-102258)

Vulnerability from cvelistv5 – Published: 2026-10-07 13:16 – Updated: 2026-10-07 14:37

Summary

Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC).

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 14:37 UTC

CWE

CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')

Assigner

sonicwall mitre root Scorecard

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	SMA1000	Affected: 12.4.3-03526 (platform-hotfix) and older versions Affected: 12.5.0-02952 (platform-hotfix) and older versions

Date Public

2026-10-07 13:01

Credits

Brian Mariani

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-102258",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T14:37:28.413381Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T14:37:48.768Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "SMA1000",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "12.4.3-03526 (platform-hotfix) and older versions"
            },
            {
              "status": "affected",
              "version": "12.5.0-02952 (platform-hotfix) and older versions"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brian Mariani"
        }
      ],
      "datePublic": "2026-10-07T13:01:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC)."
            }
          ],
          "value": "Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T13:16:31.279Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0017",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-102258",
    "datePublished": "2026-10-07T13:16:31.279Z",
    "dateReserved": "2026-09-28T19:39:42.850Z",
    "dateUpdated": "2026-10-07T14:37:48.768Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

WID-SEC-W-2026-3757

CVE-2026-102255 (GCVE-0-2026-102255)

CVE-2026-102256 (GCVE-0-2026-102256)

CVE-2026-102257 (GCVE-0-2026-102257)

CVE-2026-102258 (GCVE-0-2026-102258)

Tags

Sightings

Nomenclature

Related by attack behaviour