1.0 Introduction
Recently, SonicWall has released security updates to address a critical vulnerability (CVE-2026-102255) affecting the SMA1000 series appliances. The same release also addresses three other vulnerabilities (CVE-2026-102256, CVE-2026-102257 and CVE-2026-102258), which require administrator access. SonicWall has not flagged the flaw as exploited, but a security firm has reported honeypot activity consistent with exploitation attempts. Earlier SMA1000 flaws were exploited in the wild this year.
2.0 Impact
Successful exploitation of this vulnerability may allow a remote unauthenticated attacker to direct the appliance to issue requests on their behalf, access internal functionality and perform unauthorized operations. The flaw is a pre-authentication server-side request forgery (SSRF) in the Appliance WorkPlace interface. The other flaws in the release include OS command injection, path traversal leading to remote code execution, and stored cross-site scripting in the management console. This may lead to unauthorized access to internal networks and system compromise.
3.0 Affected Products
?
SonicWall SMA1000 models 3210,
7210 and 8200v running 12.4.3-03526 (platform-hotfix) and older versions
? SonicWall SMA1000 models 6210, 7210 and 8200v running 12.5.0-02952 (platform-hotfix) and older versions
4.0 Recommendation
CyberSecurity
Malaysia encourages users and administrators to review the following SonicWall
security advisory and apply the necessary updates. Users are advised to update
to platform-hotfix version 12.4.3-03453 or 12.5.0-02835, or later releases.
Administrators should also review WorkPlace and management console logs for
unexpected requests and restrict access to the management interface.
Kindly refer to the following URL:
Generally, we advise users to be
updated with the latest security announcements by the vendor and follow best
practice security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999
Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017
- https://nvd.nist.gov/vuln/detail/cve-2026-102255