SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances

SonicWall has released hotfixes addressing four vulnerabilities in its SMA1000 appliances, which are used to provide remote workers access to corporate networks and applications. The most critical flaw has been rated CVSS 10.0, the highest possible severity score. This vulnerability is a Server-Side Request Forgery (SSRF) flaw that can be exploited without authentication, allowing attackers to send requests through the appliance and access internal functions. SonicWall has stated there is no evidence of active exploitation of any of the four vulnerabilities at the time of disclosure. The patches were released as hotfixes, indicating urgency in remediation. Organizations using SMA1000 appliances are strongly advised to apply the hotfixes immediately given the critical nature of the vulnerability.