CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability

Summary

CVE-2026-83549 is a post-authentication OS command injection vulnerability (CWE-78) in the Appliance Management Console (AMC) of SonicWall SMA1000 series appliances. In specific conditions, a remote attacker authenticated as an administrator can execute arbitrary OS commands, resulting in remote code execution. On its own it carries a CVSS score of 7.8, but SonicWall confirmed it is being actively exploited chained with a separate pre-authentication SSRF flaw, CVE-2026-83548 (CVSS 10.0), that removes the authentication requirement entirely.

SonicWall discovered both issues internally (credited to researchers William Perry and Adam Babis) and stated it "has investigated a case indicating the active exploitation of the vulnerabilities described in this advisory."

Vulnerability Details

Affected Versions

SMA 100 series appliances and SonicWall firewall SSL-VPN are not affected.

Attack Chain and Root Cause

1. Attacker spoofs the User-Agent string and URI parameter the Work Place
   interface uses as gating signals for CVE-2026-83548 (pre-auth SSRF)
2. The appliance opens a TCP tunnel to a target of the attacker's choosing;
   pointing it at localhost:8188 reaches the Appliance Management Console
3. The AMC treats the connection as trusted because it originates from the
   appliance's own loopback interface — no credentials are checked
4. Attacker submits an AMC request containing shell metacharacters that are
   passed to an OS command without proper neutralization (CVE-2026-83549)
5. Arbitrary OS commands execute with the AMC's privileges (root)

Standalone, CVE-2026-83549 requires an authenticated administrator session. The SSRF in CVE-2026-83548 removes that requirement by tricking the appliance into treating an external attacker's request as if it originated locally — converting a "post-auth" bug into unauthenticated RCE.

Impact of Successful Exploitation

Remediation

1. Apply the hotfix immediately — 12.4.3-03526, 12.5.0-02952, or later. SonicWall states there is no workaround for this attack chain.
2. Audit AMC access logs for connections originating from localhost or the loopback interface that do not correspond to legitimate internal processes.
3. Review Work Place interface logs for requests using unusual or spoofed User-Agent strings and unexpected URI parameters.
4. Treat any device with indicators of compromise as fully compromised — SonicWall and independent responders recommend re-imaging rather than trusting an in-place patch when exploitation is suspected.
5. Restrict management-console exposure to trusted internal networks wherever the deployment allows it.

Detection Indicators

References

• SonicWall Advisory
• Help Net Security — SonicWall SMA 1000 CVE-2026-83548 / CVE-2026-83549
• The Hacker News — Attackers Exploit Two SonicWall SMA 1000 Zero-Days

Related Reading

• SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE
• SonicWall Warns of SMA1000 Flaws Exploited in Zero-Day Attacks, Patch Now
• INC Ransomware Emerges as Dominant Threat Actor Exploiting SonicWall SMA 1000 Flaws