Critical SonicWall GMS, CSG Vulnerabilities Allow SQL Injection, Privilege Escalation

Key Takeaways

• Four critical vulnerabilities, including SQL injection and MFA bypasses, have been identified in SonicWall SMA 1000 series appliances.
• These flaws could enable remote attackers to gain elevated privileges, enumerate user credentials, and bypass multi-factor authentication.
• The most severe vulnerability carries a CVSS v3 score of 7.2.
• SonicWall has released hotfixes, and immediate patching is strongly recommended, as no alternative mitigations exist.
• No in-the-wild exploitation has been observed for these specific vulnerabilities.

SonicWall has issued an urgent security advisory detailing four significant vulnerabilities affecting its Secure Mobile Access (SMA) 1000 series appliances. These flaws present a substantial risk, potentially allowing remote attackers to achieve privilege escalation, circumvent multi-factor authentication (MFA), and discover user credentials.

Given that SMA appliances function as essential secure gateways for remote workforces, their compromise could grant unauthorized access to an organization’s internal networks. The most critical of these vulnerabilities has been assigned a CVSS v3 score of 7.2, emphasizing the immediate need for network administrators to apply available patches.

Encouragingly, SonicWall has confirmed that there is currently no evidence of these specific vulnerabilities being actively exploited in real-world attacks. The company also clarified that these identified issues do not impact the SSL-VPN functionalities present in standard SonicWall firewalls.

Detailed Vulnerability Analysis

The advisory highlights four distinct Common Vulnerabilities and Exposures (CVEs) impacting the SMA1000 series. These vulnerabilities were brought to light by security researchers Anthony Cihan, Danti Gionatan, and Philip Boldt.

• CVE-2026-4112 (CVSS 7.2): This critical improper neutralization vulnerability allows an authenticated remote attacker with read-only privileges to execute SQL injection attacks. Successful exploitation can lead to a full privilege escalation, granting the attacker primary administrator control over the system.
• CVE-2026-4113 (CVSS 5.3): An observable response discrepancy vulnerability enables an unauthenticated remote attacker to successfully enumerate SSL VPN user credentials, potentially aiding in further targeted attacks.
• CVE-2026-4114 (CVSS 6.6): This flaw involves improper handling of Unicode encoding, allowing an authenticated remote SSL VPN administrator to completely bypass the AMC time-based one-time password (TOTP) authentication mechanism.
• CVE-2026-4116 (CVSS 6.0): A related Unicode handling issue allows an authenticated remote SSL VPN user to bypass TOTP authentication for both Workplace and Connect Tunnel access.

With no available workarounds or alternative mitigations, administrators must deploy the provided platform hotfixes to secure their networks against these threats. Neglecting to patch these appliances leaves organizations exposed to significant risks, particularly from the TOTP bypass vulnerabilities, which effectively neutralize crucial multi-factor authentication defenses.

What You Should Do

Organizations utilizing SonicWall SMA 1000 series appliances must take immediate action:

• Download and apply hotfixes: Obtain the latest platform hotfixes directly from the MySonicWall portal.
• Verify current versions:
  • If SMA1000 appliances are running version 12.4.3-03245 or older, upgrade them to version 12.4.3-03387 or higher.
  • If SMA1000 appliances are running version 12.5.0-02283 or older, upgrade them to version 12.5.0-02624 or higher.
• Monitor for anomalies: Remain vigilant for any unusual activity or access attempts on SMA appliances and connected internal networks.
• Review access logs: Regularly review access logs for any unauthorized login attempts or privilege changes.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.