SonicWall Issues Critical Hotfixes for SMA1000 Pre-Authentication SSRF Vulnerability

SonicWall has released hotfixes for four flaws in its SMA1000 appliances, the gateways that give remote workers access to a company's network and applications. The most serious could allow an attacker without a login to send requests through the appliance and reach internal functions.

SonicWall rates the most serious flaw 10.0 on the CVSS scale and says it has no evidence that any of the four flaws is being exploited in the wild. The vulnerabilities affect SMA1000 appliances, which serve as remote access gateways for organizations.

The company has not disclosed detailed technical information about the flaws prior to patch deployment, but the SSRF vulnerability's 10.0 rating indicates it could allow complete compromise of the gateway and potentially connected internal systems. SonicWall advises users to apply the latest firmware or hotfix immediately from the SonicWall support portal.

Security experts note that pre-authentication SSRF flaws are particularly dangerous as they can be exploited without any prior access to the target system, potentially allowing attackers to scan internal networks, access metadata services, or trigger additional attacks from within the protected network.