Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
Critical SSRF vulnerability in SonicWall SMA 1000 devices is actively being exploited.
Run SonicWall?
Get an email when a reviewed story names SonicWall, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A critical Server-Side Request Forgery (SSRF) vulnerability, designated CVE-2023-34064, is actively being exploited in SonicWall's Secure Mobile Access (SMA) 1000 series appliances. This flaw allows unauthenticated attackers to perform arbitrary requests on behalf of the appliance, potentially leading to further network compromise. SonicWall has released patches, but customers are urged to update immediately due to ongoing attacks.
The lesson from this incident
Full lessonA maximum-severity Server-Side Request Forgery (SSRF) vulnerability in SonicWall SMA 1000 series appliances is being actively exploited, allowing unauthenticated attackers to issue arbitrary requests through the appliance and pivot deeper into internal networks. The root issue lies in insufficient input validation on a publicly accessible service, compounded by delayed patch adoption among customers. Because these are edge devices designed to broker secure remote access, a compromise can expose an organization's entire internal network perimeter. This incident underscores how internet-facing network appliances are high-value, high-risk targets that require near-immediate patching when critical vulnerabilities are disclosed.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
- cve — CVE-2023-34064