A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. By using an encoded URL, a remote unauthenticated attacker could potentially cause the appliance to make requests to unintended locations.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.2 | CVE-2025-40595 |
Exploitation
To exploit this vulnerability, an attacker can craft a specially encoded URL and send it to the SMA1000 Appliance Work Place interface. If successful, the appliance may be tricked into making requests to internal or external systems that should not be accessible, potentially exposing sensitive information or services.
Affected Products
- SMA1000 Appliance: Affected due to the SSRF vulnerability in its Work Place interface, allowing unauthorized requests.
Mitigation
To mitigate this vulnerability, it is recommended to apply any available patches from SonicWALL and to restrict access to the SMA1000 Appliance Work Place interface to trusted networks only.