A pre‑authentication Server‑Side Request Forgery flaw in SonicWall’s SMA1000 Appliance Work Place interface allows a remote attacker to exploit an unintended alternate access path. By directing the appliance to issue HTTP requests on the attacker’s behalf, the attacker can reach internal services, read sensitive data or trigger unauthorized operations that the device is permitted to perform. Because no authentication is required, the vulnerability exposes the network to potential confidentiality, integrity or availability risks, depending on which internal resources are accessed.

The affected product is the SonicWall SMA1000 Appliance. Any instance that runs the Work Place interface with the alternate access path is vulnerable. No explicit version range is listed, so provisioning a patch requires checking the current firmware against SonicWall’s advisory for this specific issue.

The exploit path is remote and unauthenticated, meaning that an attacker who can reach the Work Place interface can configure the appliance to send requests to arbitrary internal targets. The EPSS score is not available, but the absence of a KEV listing suggests the vulnerability has not yet been widely exploited. Nevertheless, the lack of authentication and the broad capability of SSRF create a high risk scenario; security teams should assume a high likelihood of exploitation until a vendor fix is applied. The CVSS score of 10.0 confirms maximum severity.