SonicWall patches a CVSS 10 pre-login SSRF flaw in its SMA1000 appliances

Server-side request forgery lets the attacker use the appliance's own position on the network. The SMA1000 sends the requests itself, so an outsider can reach functions meant only for internal callers ^[5]. "By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations," SonicWall said ^[5].

In that description, the SSRF stops at "unauthorized operations" ^[5]. Code execution sits in the other three fixes ^[6]. An SMA1000 on an older build has both problems at once: a request path that works before login, and at least one flaw that can be exploited for remote code execution ^[12]. The SecurityWeek report does not say whether those other flaws need a login, and it ties no threat actor or earlier campaign to SMA1000 appliances ^[6].

So this is a vendor patch, and no incident has been reported against it ^[7]. The no-exploitation status comes from SonicWall alone and describes the day of release, Wednesday ^[1][7]. I'd rank the bug on reach. Anyone who can send traffic to the appliance can attempt it ^[3].

Splunk patched a related kind of bug the same day ^[1]. Its MCP Server had a medium-severity defect that let an authenticated user change API settings so the product sent requests to an attacker-controlled URL ^[11]. Both bugs make a product send requests to a destination the attacker picks. Splunk's needs a logged-in user. SonicWall's needs none ^[3][11].