CVE-2026-102255 PUBLISHED

Assigner: sonicwall
Reserved: 28.09.2026 Published: 07.10.2026 Updated: 07.10.2026

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.

Product Status

Vendor SonicWall
Product SMA1000
Versions Default: unknown
  • Version 12.4.3-03526 (platform-hotfix) and older versions is affected
  • Version 12.5.0-02952 (platform-hotfix) and older versions is affected

References

Problem Types

  • CWE-918 Server-Side request forgery (SSRF) CWE
  • CWE-441 Unintended Proxy or Intermediary ('Confused Deputy') CWE