CVE-2026-0206
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A post-authentication stack-based buffer overflow vulnerability in SonicOS allows a remote attacker to crash a firewall.
Risk Assessment
An authenticated attacker could remotely crash the firewall, causing a gap in network protection and service unavailability. This could be used to weaken defenses against further attacks.
Recommendation
Update SonicOS to a version containing the fix and restrict administrative access to the firewall to trusted networks.
Other vulnerabilities in SonicOS
See all- CVE-2020-5135CriticalActively exploited
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. It affects SonicOS Gen 6 versions 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
- CVE-2026-0516Medium
SonicOS contains a vulnerability related to improper neutralization of HTTP headers for scripting syntax. A remote attacker can manipulate the Host header and redirect firewall management users to arbitrary web domains.
- CVE-2026-0205Medium
A post-authentication path traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services. The attacker must be authenticated to exploit this flaw.
- CVE-2026-0204High
A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions.
Original NVD description (English source)
A post-authentication Stack-based Buffer Overflow vulnerabilities in SonicOS allows a remote attacker to crash a firewall.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS