SonicWall SMA1000 Multiple Vulnerabilities Advisory (CVE-2026-4112/4113/4114/4116)

Vulnerability Overview Advisory ID: SMAUD-2026-0003 Overall CVSS Score: 7.2 Affected Products: SonicWall SMA1000 Series Devices This advisory concerns four primary vulnerabilities: 1. CVE-2026-4112 (CVSS 7.2): Privilege escalation via SQL injection. SQL commands in SonicWall SMA1000 series devices are not properly sanitized against special characters, allowing remote authenticated attackers with read-only administrator privileges to escalate to full administrator privileges. 2. CVE-2026-4113 (CVSS 5.3): Authentication response discrepancy leading to credential enumeration. A detectable response discrepancy vulnerability exists on the device, allowing remote attackers to enumerate SSL VPN user credentials. 3. CVE-2026-4114 (CVSS 6.6): Unicode handling may bypass AMC TOTP. Improper Unicode handling on the device allows remote authenticated SSL VPN administrators to bypass AMC TOTP authentication. 4. CVE-2026-4116 (CVSS 6.0): Unicode handling may bypass WorkplaceConnect Tunnel TOTP. Improper Unicode handling on the device allows remote authenticated SSL VPN users to bypass WorkplaceConnect Tunnel TOTP authentication. Note: There is currently no evidence indicating these vulnerabilities are being exploited in the wild. SSL VPN running on SonicWall firewalls is not affected by these vulnerabilities. Scope of Impact Product: SMA1000 Affected Versions: 12.4.3-03245 (platform-hotfix) and earlier 12.5.0-02283 (platform-hotfix) and earlier Remediation Fixed Versions: 12.4.3-03387 (platform-hotfix) and later 12.5.0-02624 (platform-hotfix) and later Workarounds: None. POC Code No POC code is included in the screenshots.

Goal Reached Thanks to every supporter — we hit 100%!

SonicWall SMA1000 Multiple Vulnerabilities Advisory (CVE-2026-4112/4113/4114/4116)