DEV Community

StarkMan
StarkMan

Posted on

SonicWall SMA1000 Command Injection (CVE-2026-83549): Chained Zero-Day to Root on the Edge

#vulnerability #sonicwall #sma1000 #cve202683549

SonicWall SMA1000 Command Injection (CVE-2026-83549): Chained Zero-Day to Root on the Edge

Vulnerability overview

CVE-2026-83549 is an OS command injection flaw (CWE-78) in the Appliance Management Console (AMC) of SonicWall Secure Mobile Access (SMA) 1000 series appliances. NVD records a CVSS v3.1 base score of 7.8 (High). Reaching the vulnerable function requires administrator authentication, which is why it is rated below the pre-authentication SSRF in the same advisory.
SonicWall published the fix on 1 September 2026 in security advisory SNWLID-2026-0016, which covers CVE-2026-83548 and CVE-2026-83549. CISA added CVE-2026-83549 to the Known Exploited Vulnerabilities (KEV) catalog on 2 September 2026 on evidence of active exploitation, with a federal remediation deadline of 5 September 2026.

Mechanism and exploitation conditions

The AMC is the administrative interface used to manage the appliance. It passes administrator-supplied input into an operating system command without neutralizing the special elements that a shell interprets, so an authenticated administrator can inject and execute arbitrary commands on the appliance operating system.
The authentication requirement is why this CVE matters most as the second stage of a chain. CVE-2026-83548, a pre-authentication server-side request forgery rated CVSS 10.0, lets an unauthenticated attacker make the appliance issue requests to internal services. Reported analyses describe the combined path as SSRF first, to reach internal management interfaces, then command injection through the AMC to run code. Public reporting states the chain ends in command execution with root privileges on the appliance.
Two conditions bound real-world exploitation. The attacker needs a reachable AMC, either directly or through the SSRF pivot, and needs to satisfy the administrator authentication step. Where multi-factor authentication is enforced, that step is harder to complete, but the underlying injection flaw remains.

Impact

Successful exploitation gives an attacker command execution on a device that sits at the network edge. SMA 1000 appliances terminate remote access for distributed staff, so control of the appliance places an attacker in a position to observe and manipulate remote access traffic, and to move toward internal systems that trust the appliance. The injected commands run with the privileges of the AMC process, and reporting describes the outcome as root-level control of the device.
CISA's KEV listing reflects confirmed exploitation rather than a theoretical risk. Public reporting links exploitation of the SMA1000 pair to ransomware deployment, which raises the operational stakes for any organization still running an unpatched appliance.

Affected products and scope

The advisory covers the SMA 1000 series, including the 6210, 7210, and 8200v models. Reported affected firmware is 12.4.3-03453 and earlier on the 12.4.3 branch, and 12.5.0-02835 and earlier on the 12.5.0 branch. The fixed builds are 12.4.3-03526 and 12.5.0-02952.
SonicWall stated that no workaround exists, so patching is the only remediation. Organizations should confirm their exact model and firmware build rather than assuming a version family is unaffected.

Exposure context

A ZoomEye query for the product fingerprint returns a large global population of matching appliances. The query app="SonicWall SMA1000" returned 5,467 matching assets at the time of checking. A CVE-scoped query, vul.cve="CVE-2026-83549", returned 0, which means ZoomEye has not indexed this CVE identifier against assets; it does not mean no vulnerable appliance is exposed.
The product-fingerprint count describes appliances that match the SMA1000 fingerprint. It does not confirm that any of those devices are unpatched or exploitable, so read it as an exposure indicator rather than a vulnerability count.

Remediation and mitigations

Upgrade to 12.4.3-03526 or 12.5.0-02952, or a later build on the same branch. SonicWall published no workaround, so organizations that cannot patch immediately should restrict management access to the appliance and monitor for the exploitation indicators described in the advisory.
Because exploitation has been confirmed in the wild, patching alone may not be sufficient on a device that was exposed while vulnerable. SonicWall's guidance for potentially compromised appliances is to reimage the device and reset all user and administrator credentials, including TOTP enrollments. Treat any credential that was valid on the appliance during the exposure window as potentially disclosed.
For validation, confirm the running firmware build after the upgrade, verify that the AMC is not reachable from untrusted networks, and review authentication logs for administrator sessions the organization cannot account for.

References

Top comments (0)