CVE-2026-4112
HighSummary
The SonicWall SMA1000 series appliances are vulnerable to SQL injection, allowing a remote attacker with read-only administrator privileges to escalate to full administrator rights.
Risk Assessment
An attacker with access to a limited privilege account could gain full control over the device, posing a significant security risk.
Recommendation
It is recommended to update the devices to the latest software version to mitigate this vulnerability and review user privileges.
Other vulnerabilities in SonicWall SMA1000 series appliances
See all- CVE-2026-4116High
Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication.
- CVE-2026-4113High
The SonicWall SMA1000 series appliances have an observable response discrepancy vulnerability that allows a remote attacker to enumerate SSL VPN user credentials.
Original NVD description (English source)
Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote authenticated attacker with read-only administrator privileges to escalate privileges to primary administrator.