A weak password hashing mechanism in SonicOS virtual appliances allows an attacker who already has local access to potentially disclose platform credentials. Those credentials grant a restricted view of platform settings, which could lead to configuration tampering or further lateral movement within the appliance. The vulnerability stems from improper handling of password storage, classified as CWE-798.

SonicWall SonicOS virtual appliances are affected. No specific version information is provided, so all releases that deploy the vulnerable hashing routine may be at risk.

The exploit requires an attacker to have existing local access; it is not a remote attack vector. The CVSS score of 5.1 indicates a medium severity, suggesting that while the vulnerability is not critical, it could still contribute to broader compromise if combined with other weaknesses. Because the EPSS score is not available and the vulnerability is not listed in CISA KEV, the known external exploitation risk is currently undefined. However, the potential impact on confidentiality and integrity of configuration data remains a concern for organizations that rely on SonicOS appliances.