GCVE-1988-2026-0037

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SonicWall SMA 1000",
          "vendor": "Sonicwall",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Full-Disclosure List,\n\nAn unauthenticated remote code execution vulnerability chain in SonicWall SMA 1000 series appliances is being disclosed \nhere. The chain yields code execution as the `mgmt-server` user (uid=1011) on the management plane, with no credentials \nand no prior knowledge of the appliance beyond a reachable address.\n\nA full technical writeup with a reproducible proof-of-concept is published at:\n\n  https://0day-rubbish.com/blog/sonicwall-sma-preauth-deserialization-rce\n\nRepository (advisory + PoC):\n\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\n-----------------------------------------------------------------\n1. Summary\n-----------------------------------------------------------------\n\nA four-stage pre-auth chain combines a Struts 1 property-injection\nflaw, an in-memory Jetty authentication-filter rewrite, an unauthenticated\nSSO Primary-Administrator token issuance, and a Java deserialization sink.\nThe result is unauthenticated RCE as `mgmt-server` (uid=1011).\n\nCVSS 3.1 base: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nVector: network, low complexity, no privileges, no user interaction.\n\n-----------------------------------------------------------------\n2. Affected product\n-----------------------------------------------------------------\n\nVendor:  SonicWall\nProduct: SMA 1000 series (Secure Mobile Access)\nFirmware: 12.4.x line (verified on a 12.4 build; other 12.x lines\n          may share the Struts 1 / Jetty console stack — not all\n          were independently tested).\nComponent: /Console management plane, Central Management Service (CMS),\n           /configUserCommunityEPC.do\n\n-----------------------------------------------------------------\n3. Vulnerability details\n-----------------------------------------------------------------\n\nStage 1 — Authentication bypass via Struts 1 property injection\n  Every Struts 1 ActionForm exposes a `multipartRequestHandler`\n  property. By walking the bean graph\n  (`servletContext -> servletHandler -> filterMappings`) an\n  unauthenticated caller can rewrite the Jetty authentication\n  filter's pathSpecs to a non-existent path and force the filter\n  cache to rebuild. The entire `/Console` API and console actions\n  become reachable without authentication.\n\nStage 2 — Enable Central Management Service\n  With `/Console` unauthenticated, Central Management Service (CMS)\n  can be enabled from the console API, preparing the SSO token path.\n\nStage 3 — Unauthenticated SSO Primary Admin token\n  GET /Console/CentralManagement/SSO/Authorize?user=admin&roleUser=Primary+Admin\n  returns a Primary Administrator token without any password. The\n  token is exchanged for a valid JSESSIONID. The attacker is now the\n  Primary Administrator, fully unauthenticated.\n\nStage 4 — Java deserialization RCE\n  The `storedCommunity` field of `/configUserCommunityEPC.do` is\n  consumed by a setter that calls `ObjectInputStream.readObject()`\n  on attacker-controlled input. A `BeanComparator` + `TemplatesImpl`\n  gadget chain is delivered through this field. The command executes\n  as `mgmt-server` (uid=1011). Output is written to the webroot and\n  read back via an anonymous GET.\n\n-----------------------------------------------------------------\n4. Impact\n-----------------------------------------------------------------\n\n- Unauthenticated remote code execution as `mgmt-server`.\n- Full compromise of the SMA 1000 management plane.\n- The appliance terminates remote-access VPN sessions; compromise\n  of the management plane can be leveraged to pivot into the\n  protected internal network and to intercept or reset VPN sessions.\n- No credentials, no user interaction, no prior appliance knowledge\n  beyond a reachable HTTPS address.\n\n-----------------------------------------------------------------\n5. Proof of concept\n-----------------------------------------------------------------\n\nA reproducible PoC is included in the repository under\n`product/sonicwall/sma-12.4/preauth-deserialization-rce/exploit`.\nThe full chain and reproduction steps are documented in the advisory\nURL above. The PoC contains no operator-identifying information and\ntargets placeholder hosts.\n\n-----------------------------------------------------------------\n6. Disclosure timeline\n-----------------------------------------------------------------\n\n- 2026-07-26: Technical writeup + PoC published to the project\n              site and repository.\n- 2026-07-27: This Full-Disclosure submission.\n\nVendor contact: SonicWall PSIRT was notified (cc'd). A coordinated\nembargo was not requested by the operator prior to publication; this\nsubmission is made in parallel with public availability of the\nwriteup.\n\n-----------------------------------------------------------------\n7. Credits\n-----------------------------------------------------------------\n\nDiscovered and documented by the 0day-Rubbish independent\nvulnerability-research project.\n\n-----------------------------------------------------------------\n8. References\n-----------------------------------------------------------------\n\n- Advisory: https://0day-rubbish.com/blog/sonicwall-sma-preauth-deserialization-rce\n- Repo:     https://github.com/Exploit-Garbage/0day-Rubbish\n\n--\n0day-Rubbish\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:28Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/2"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/2"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/sonicwall-sma-preauth-deserialization-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/2"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-Rubbish] SonicWall SMA 1000 — Pre-Auth Deserialization RCE (CVSS 9.8) via Struts 1 Property Injection and Auth-Filter Rewrite",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0037",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/2",
            "automated": true,
            "contentSha256": "78588e06d62af725c03928b8b4da89488c10191a6628c7abfa57534c7dde9d20",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/2",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-27T03:58:55Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-09T10:11:28Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0037"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}