Known vulnerabilities in SonicWall SMA 1000 12.4.2-02044

Known vulnerabilities in SonicWall SMA 1000 12.4.2-02044

Vendor: SonicWall

Software: SonicWall SMA 1000

Version: 12.4.2-02044

Software CPE: cpe:2.3:h:sonicwall:sma_1000:*:*:*:*:*:*:*:*

Website: https://www.sonicwall.com/

Total vulnerabilities: 15

Public exploits: 4

Known exploited (KEV): 4

Vulnerabilities by Severity

Vulnerabilities (15)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU153400 - Server-Side Request Forgery (SSRF) CVE-2026-102255	CWE-918	High	No	No	12.4.3-03670, 12.5.0-03082	06.10.2026	SB2026100662
#VU153401 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CVE-2026-102256	CWE-78	Low	No	No	12.4.3-03670, 12.5.0-03082	06.10.2026	SB2026100662
#VU153402 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2026-102257	CWE-22	Low	No	No	12.4.3-03670, 12.5.0-03082	06.10.2026	SB2026100662
#VU153403 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-102258	CWE-79	Low	No	No	12.4.3-03670, 12.5.0-03082	06.10.2026	SB2026100662
#VU146659 - Server-Side Request Forgery (SSRF) CVE-2026-83548	CWE-918	Critical	Public exploit available	Exploited	12.4.3-03526, 12.5.0-02952	02.09.2026	SB2026090221
#VU146660 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CVE-2026-83549	CWE-78	High	Public exploit available	Exploited	12.4.3-03526, 12.5.0-02952	02.09.2026	SB2026090221
#VU125516 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2026-4112	CWE-89	Low	No	No	12.4.3-03387, 12.5.0-02624	08.04.2026	SB20260408177
#VU125517 - Observable Response Discrepancy CVE-2026-4113	CWE-204	Low	No	No	12.4.3-03387, 12.5.0-02624	08.04.2026	SB20260408177
#VU125518 - Improper Handling of Unicode Encoding CVE-2026-4114	CWE-176	Low	No	No	12.4.3-03387, 12.5.0-02624	08.04.2026	SB20260408177
#VU125519 - Improper Handling of Unicode Encoding CVE-2026-4116	CWE-176	Low	No	No	12.4.3-03387, 12.5.0-02624	08.04.2026	SB20260408177
#VU120180 - Missing Authorization CVE-2025-40602	CWE-862	High	No	Exploited	12.4.3-03245, 12.5.0-02283	17.12.2025	SB2025121748
#VU109189 - Server-Side Request Forgery (SSRF) CVE-2025-40595	CWE-918	High	No	No	12.4.3-02963	14.05.2025	SB2025051463
#VU108094 - Server-Side Request Forgery (SSRF) CVE-2025-2170	CWE-918	High	No	No	12.4.3-02925	30.04.2025	SB2025043043
#VU61110 - Use of Uninitialized Resource CVE-2022-0847	CWE-908	Low	Public exploit available	Exploited	12.4.2-05082	08.03.2022	SB2022030808 SB2022031019 SB2022031026 and 27 more
#VU55143 - Integer overflow CVE-2021-33909	CWE-190	Low	Public exploit available	No	12.4.2-05082	21.07.2021	SB2021072106 SB2021072222 SB2021072223 and 63 more