lee1981 (@lee1981b) on X

What it is

CVE-2026-102255 is a pre-authentication SSRF / confused-deputy flaw (CWE-918, CWE-441) in the SonicWall SMA1000 Work Place interface, covering models 6210, 7210 and 8200v. SonicWall (SNWLID-2026-0017) rates it Critical, CVSS v3.0 10.0, vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The advisory was published and last updated 6 October, and the CVE record on 7 October. SonicWall excludes SSL-VPN on its firewalls and the SMA 100 Series.

How it works

An unauthenticated caller reaches an unintended alternate access path and gets the appliance to issue requests into internal functionality that should stay protected. Receiving services see the gateway as the caller, not the original requester. The page says the request mechanics (URL, parameter, payload, destinations) are unpublished, so there is no CVE-specific IOC or signature. Successful login is not required, so session logs may omit the attack.

Preconditions / Affected

• Explicitly affected: platform hotfix 12.4.3-03526 and older, and 12.5.0-02952 and older.
• Fixed: 12.4.3-03670 and higher on the 12.4.3 train, 12.5.0-03082 and higher on 12.5.0.
• Gap: builds between the affected ceilings and the fixed floors are not classified in SonicWall's tables. Refer them to SonicWall and do not mark them safe.
• Compare within the correct train only. A bare "12.4.3" or "12.5.0" string is insufficient, and a client package version proves nothing about the appliance.
• Check standby and DR nodes too.

What to do

1. Scope: use AMC and CMS inventory to record model, role, exact running hotfix and reachable WorkPlace paths for every node. Reconcile against actual node state.
2. Preserve evidence before any restart: export AMC logs under Monitoring > Logging (System message, Management message, Management audit, Management access, Web proxy audit). The AMC screen defaults to the last 50 messages and is capped, so use supported export. Also keep edge/reverse-proxy records.
3. Hunt appliance-originated requests: check egress firewall, flow, DNS and destination logs for new or unusual appliance-to-internal connections outside approved workflows. Literal-IP requests may leave no DNS event, and loopback handling may escape sensors.
4. Correlate the receiving service: have the owner identify the operation, identity, object touched and approval. In Management audit, distinguish pending from applied configuration changes (the "Applied configuration changes" event).
5. Patch: obtain the package via MySonicWall and install it under System Configuration > Maintenance > System software updates, then restart.
6. Verify: check AMC Dashboard > System > System Information on every node, requiring at least 12.4.3-03670 or 12.5.0-03082.

SonicWall lists no workaround. Owner-approved reachability or egress restrictions may reduce risk while scheduling, but they are not a fix.

Caveats

• Exploitation: SonicWall reports no evidence of exploitation in the wild. The CISA KEV catalogue (2026.10.08) has no match. CISA SSVC on 7 October gave exploitation none, automatable yes, technical impact total. FIRST EPSS on 8 October was 0.477% (percentile 39.2%). The page says private exploitation is not ruled out and that no public exploit was verified.
• NVD was "Awaiting Analysis" at the 9 October cutoff. The CISA-ADP v3.1 score of 10.0 is secondary, not independent NIST scoring.
• The same bundle includes CVE-2026-102256, CVE-2026-102257 and CVE-2026-102258, which are separate authenticated flaws. No chain to this CVE was established.
• A vulnerable build establishes exposure, not compromise. Keep four outcomes separate: exposure, suspicious lead, corroborated unauthorised activity, and telemetry gap.
• The author's helper checks were run only on synthetic inventory fixtures, not on a live appliance.