PT-2023-5520 · Sonicwall · Sonicwall Sma1000
Published
2023-01-19
·
Updated
2024-03-21
·
CVE-2023-0126
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
SonicWall SMA1000 version 12.4.2
Description
The issue is a pre-authentication path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory. This can be exploited by an attacker to gain unauthorized access to sensitive information. The vulnerability is present in the SMA1000 firmware version 12.4.2. Approximately 576 assets can be discovered using ZoomEye, indicating a significant number of potentially affected devices.
Recommendations
For SonicWall SMA1000 version 12.4.2, as a temporary workaround, consider restricting access to the vulnerable API endpoint
http://$host:8443/images until a patch is available. Avoid using the images directory in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sonicwall Sma1000