An unauthenticated attacker that can reach the SonicWall Global Management System over the network can retrieve internal files from the device. The information exposed includes configuration files, credentials, and other sensitive data, which could be used for further attacks or compromise of the network environment. The vulnerability does not provide direct execution or denial of service, but it offers a foothold that could lead to escalation if the attacker obtains legitimate administrative information.

The flaw affects SonicWall Global Management System, specifically versions 9.5.2 and earlier. All installations of these versions that are reachable from an external network are potentially vulnerable.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so publicly available data on exploitation frequency is limited. However, the vulnerability is reachable over the network and requires no authentication, implying a relatively high ease of exploitation for an attacker with network access. With a CVSS score of 9.1, the vulnerability is classified as critical, indicating that exposure of sensitive configuration data poses a high risk to organizations that have the vulnerable GMS exposed to untrusted networks.