## https://sploitus.com/exploit?id=C6CC4F4D-1911-58D8-A29F-C7199A6F7A3C
# SonicWall SMA 1000 — CVE-2026-83548 / CVE-2026-83549 Exposure Detector
A **non-intrusive** detection script for SonicWall Secure Mobile Access (SMA) 1000
series appliances affected by **CVE-2026-83548** (pre-auth SSRF in the Work Place
interface, CVSS 10.0) and **CVE-2026-83549** (post-auth OS command injection in the
AMC, CVSS 7.8) — two actively-exploited zero-days chained for unauthenticated RCE.
> This is a **patch-state / exposure check**, not an exploit. It performs only
> read-only HTTP(S) GET requests, sends **no** SSRF or command-injection payload,
> and makes **no** authentication attempt. There is no proof-of-concept here.
## What it does
1. Fetches the target's root page over HTTPS.
2. Fingerprints whether it is a SonicWall SMA 1000 **WorkPlace** portal
(`Server: SMA/*`, `__extraweb__` assets, `SMA 1000 Series` help link).
3. Extracts the firmware version the appliance advertises.
4. Compares it against SonicWall's published **fixed** builds and reports:
- **PATCHED** — build ≥ the fixed build for its line.
- **AFFECTED** — build = 12.5.0-02952) builds, so patch state is UNDETERMINED from outside. Verify
the build locally (appliance console / AMC): confirm it is >= 12.5.0-02952.
```
### Exit codes
| Code | Meaning |
|------|-------------------------------------------|
| 0 | Patched / not affected |
| 1 | Affected, or potentially affected (verify)|
| 2 | Not an SMA 1000 / undetermined |
| 3 | Connection or other error |
## Remediation
Upgrade to **12.4.3-03526** or **12.5.0-02952** (or later) per SonicWall's advisory.
Because these CVEs are **actively exploited in the wild**, if an appliance was running
a vulnerable build while internet-exposed, treat it as potentially compromised: check
the vendor's indicators of compromise, and if any are present, reimage the appliance
and reset all user/administrator passwords and TOTP/MFA credentials. Restrict AMC /
management-plane access to trusted networks only.
## References
- SonicWall Product Notice **SNWLID-2026-0016**
- **CVE-2026-83548** — pre-auth SSRF, SMA 1000 Work Place interface (CVSS 10.0)
- **CVE-2026-83549** — post-auth OS command injection, AMC (CVSS 7.8)
- CISA Known Exploited Vulnerabilities (KEV) catalog
## Legal / authorized use
This tool is for **authorized** security testing and defensive patch-verification only.
Run it only against systems you own or have explicit written permission to test.
Unauthorized scanning may be illegal. The authors accept no liability for misuse.
Provided under the MIT License — see [LICENSE](LICENSE).