SonicWall SMA1000 Pre-Auth SSRF to Command Injection (CVE-2026-83548 / 83549)

Pre-auth WorkPlace SSRF (CVSS 10.0) chains into AMC OS command injection on SMA1000 6210/7210/8200v — vendor-confirmed exploitation; hotfixes 12.4.3-03526 and 12.5.0-02952.

Summary

On 2026-09-01 SonicWall PSIRT (SNWLID-2026-0016) disclosed two actively exploited flaws in SMA1000 secure remote-access / SSL-VPN appliances (models 6210, 7210, 8200v):

CVE-2026-83548 — pre-authentication server-side request forgery in the Appliance WorkPlace interface (CVSS 10.0). An unintended alternate access path lets an unauthenticated remote attacker reach functionality that should be authenticated (CWE-918 / confused deputy).
CVE-2026-83549 — OS command injection in the Appliance Management Console (AMC) (CVSS 7.8). Alone it needs an administrator; chained with the SSRF it becomes unauthenticated RCE.

CISA added both IDs to the KEV catalog on 2026-09-02. Shadowserver has tracked 400+ internet-exposed SMA1000s. SMA 100 Series and firewall SSL-VPN are not affected.

Patching does not prove the box was clean: SonicWall has urged IoC review with support; confirmed intrusion means re-image, credential rotation, and TOTP reset.

OFFSITE.DARK indexes the advisory and KEV listing. No public PoC was identified in the defender reporting used here.

Key Findings

Finding	Detail
CVE-2026-83548	Pre-auth SSRF on WorkPlace — CVSS 10.0
CVE-2026-83549	Post-auth OS command injection on AMC — CVSS 7.8
Chain	SSRF reaches AMC → unauthenticated command execution
Affected	SMA1000 6210, 7210, 8200v (physical and virtual)
Vulnerable trains	12.4.3-03453 hotfix and earlier; 12.5.0-02835 hotfix and earlier
Fixed hotfixes	12.4.3-03526, 12.5.0-02952 and later
Not affected	SMA 100 Series; SonicWall firewall SSL-VPN
Exploitation	Vendor-confirmed in the wild at or before disclosure
Exposure	400+ internet-facing SMA1000 (Shadowserver)

Chain (conceptual)

Internet attacker → SMA1000 WorkPlace (no login)
        ↓
CVE-2026-83548 — WorkPlace proxies the request to internal management
        ↓
AMC receives a privileged operation it should not have accepted from the WAN
        ↓
CVE-2026-83549 — command injection in the management console
        ↓
OS-level code execution on the appliance

Do not expose AMC to untrusted networks even after patching; the SSRF existed specifically to defeat that isolation.

Impact

Full appliance compromise = VPN/session secrets, LDAP/RADIUS binds, and a foothold into the networks SMA1000 was meant to gate.
SonicWall appliances have a long KEV history (ransomware and espionage). This pair is another edge-device emergency, not a workstation CVE.
Hotfix-only close-out: operators on lagged 12.4.3 / 12.5.0 platform hotfixes are still open.

Mitigation

Upgrade to 12.4.3-03526 or 12.5.0-02952 (or newer) immediately.
After patching: contact SonicWall support for compromise assessment; if IoCs hit, rebuild the appliance rather than trusting on-box cleanup.
Rotate VPN user secrets, admin passwords, LDAP/AD binds, certificates, and TOTP seeds.
Restrict WorkPlace and AMC to trusted source IPs; do not publish management to the world.
Hunt 2026-09-01-window sessions and unexpected admin configuration changes.

Related Signals

Sources

→ Source