SonicWall SMA1000
19 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-102258 | 12.4.3-03526 (platform-hotfix) and older versions ; 12.5.0-02952 (platform-hotfix) and older versions | Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) wh | MEDIUM 6.1 | 0.4 % | ||
| CVE-2026-102257 | 12.4.3-03526 (platform-hotfix) and older versions ; 12.5.0-02952 (platform-hotfix) and older versions | A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the | HIGH 7.2 | 0.7 % | ||
| CVE-2026-102256 | 12.4.3-03526 (platform-hotfix) and older versions ; 12.5.0-02952 (platform-hotfix) and older versions | Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identi | HIGH 7.8 | 0.5 % | ||
| CVE-2026-102255 | 12.4.3-03526 (platform-hotfix) and older versions ; 12.5.0-02952 (platform-hotfix) and older versions | A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By | CRITICAL 10.0 | 1.0 % | ||
| CVE-2026-83549 | 12.4.3-03453 (platform-hotfix) and older versions ; 12.5.0-02835 (platform-hotfix) and older versions | Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identi | HIGH 7.8 | 9.9 % | KEV | |
| CVE-2026-83548 | 12.4.3-03453 (platform-hotfix) and older versions ; 12.5.0-02835 (platform-hotfix) and older versions | A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A r | CRITICAL 10.0 | 8.0 % | KEV | |
| CVE-2026-15410 | 12.4.3-03245 – 12.4.3-03434 ; 12.5.0-02283 – 12.5.0-02800 | Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Man | HIGH 7.2 | 12 % | KEV | |
| CVE-2026-15409 | 12.4.3-03245 – 12.4.3-03434 ; 12.5.0-02283 – 12.5.0-02800 | A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticat | CRITICAL 10.0 | 6.8 % | KEV | |
| CVE-2026-4116 | 12.4.3-03245 (platform-hotfix) and earlier versions. ; 12.5.0-02283 (platform-hotfix) and earlier versions. | Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/C | HIGH 7.2 | 0.4 % | ||
| CVE-2026-4114 | 12.4.3-03245 (platform-hotfix) and earlier versions. ; 12.5.0-02283 (platform-hotfix) and earlier versions. | Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP a | MEDIUM 6.6 | 0.6 % | ||
| CVE-2026-4113 | 12.4.3-03245 (platform-hotfix) and earlier versions. ; 12.5.0-02283 (platform-hotfix) and earlier versions. | An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN us | HIGH 7.2 | 0.4 % | ||
| CVE-2026-4112 | 12.4.3-03245 (platform-hotfix) and earlier versions. ; 12.5.0-02283 (platform-hotfix) and earlier versions. | Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote | HIGH 7.2 | 0.6 % | ||
| CVE-2025-40602 | 12.4.3-03093 (platform-hotfix) and earlier versions ; 12.5.0-02002 (platform-hotfix) and earlier versions | A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC). | MEDIUM 6.6 | 2.8 % | KEV | |
| CVE-2025-40595 | 12.4.3-02925 (platform-hotfix) and earlier versions | A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. By using an encoded UR | HIGH 7.2 | 0.4 % | ||
| CVE-2025-2170 | 12.4.3-02907 (platform-hotfix) and earlier versions | A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface, which in specific cond | HIGH 7.2 | 0.3 % | ||
| CVE-2025-23006 | 12.4.3-02804 (platform-hotfix) and earlier versions. | Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and | CRITICAL 9.8 | 27 % | KEV | |
| CVE-2024-45317 | 12.4.3-02676 and earlier versions | A Server-Side Request Forgery (SSRF) vulnerability in SMA1000 appliance firmware versions 12.4.3-02676 and earlier allows a remote, unauthen | HIGH 7.5 | 0.6 % | ||
| CVE-2020-5132 | SMA1000 12.4.0-2223 | SonicWall SSL-VPN products and SonicWall firewall SSL-VPN feature misconfiguration leads to possible DNS flaw known as domain name collision | MEDIUM 5.3 | 1.0 % | ||
| CVE-2020-5129 | 12.1.0-06411 and earlier | A vulnerability in the SonicWall SMA1000 HTTP Extraweb server allows an unauthenticated remote attacker to cause HTTP server crash which lea | HIGH 7.5 | 1.3 % |