The vulnerability lies in the access control mechanism of SonicOS, allowing certain management interface functions to be reachable when specific conditions apply. This could enable an attacker to perform privileged operations without proper authorization, compromising configuration integrity and potentially allowing further exploitation. The weakness is of type improper authorization and insecure default configuration, as reflected by CWE-1390 and CWE-306.

SonicWall’s SonicOS firmware is affected. No specific product versions are listed in the advisory, so the vulnerability could be present across multiple releases until addressed. Organizations running SonicOS should verify the firmware version against SonicWall’s security advisory.

The advisory provides a CVSS score of 8, indicating a high severity vulnerability. The EPSS estimate is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting no widespread exploitation is documented to date. The likely attack surface is the management interface exposed over the network, which could be accessed by internal or potentially external actors if the interface is reachable. Without a documented exploitation method, the risk appears moderate, yet the flaw permits unauthorized use of management functions, presenting a significant potential impact if exploited. Organizations should consider this a medium to high risk until a patch is applied.