Critical · published January 23, 2025
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 97.8th percentile for exploit probability.
🚨 Pre-authentication code execution is a massive risk with the SMA1000 Appliance Management Console! An attacker could potentially execute arbitrary OS commands without any authentication. 🔥 Think of it like a delivery person gaining access to a secure building without verification, where they can not only drop off packages but also access sensitive areas and do whatever they please. This vulnerability allows attackers to waltz right in, no questions asked! The consequences here could be absolutely devastating—an attacker could run any command on your system, leading to unauthorized access, data breaches, or even complete system compromise. We're talking about a potential full takeover of your environment!
Think of it like a delivery person gaining access to a secure building without verification, where they can not only drop off packages but also access sensitive areas and do whatever they please. This vulnerability allows attackers to waltz right in, no questions asked! This vulnerability arises from a pre-authentication deserialization flaw in the SMA1000 Appliance Management Console and Central Management Console, allowing unauthenticated attackers to exploit this weakness to execute arbitrary OS commands remotely.
The consequences here could be absolutely devastating—an attacker could run any command on your system, leading to unauthorized access, data breaches, or even complete system compromise. We're talking about a potential full takeover of your environment! Immediate action is critical! Update your SMA1000 systems to the latest version as soon as possible, ensuring you're on the patched release. Additionally, review your security configurations to minimize exposure and consider enabling access controls to limit unauthorized access. 🛡️ You've got this! Stay vigilant, apply those patches, and fortify your defenses! ✨
| Product | Versions | Fixed in |
|---|---|---|
| sonicwall/sma8200v | < 12.4.3-02854 | 12.4.3-02854 |
| sonicwall/sma6200_firmware | < 12.4.3-02854 | 12.4.3-02854 |
| sonicwall/sma6210_firmware | < 12.4.3-02854 | 12.4.3-02854 |
| sonicwall/sma7200_firmware | < 12.4.3-02854 | 12.4.3-02854 |
| sonicwall/sma7210_firmware | < 12.4.3-02854 | 12.4.3-02854 |
| sonicwall/sra_ex6000_firmware | ≤ 12.4.3-02804 | — |
| sonicwall/sra_ex7000_firmware | ≤ 12.4.3-02804 | — |
| sonicwall/sra_ex9000_firmware | ≤ 12.4.3-02804 | — |