The vulnerability is an observable response discrepancy that allows attackers to determine valid SSL VPN usernames on a SonicWall SMA1000 appliance. It is a CWE-204 type flaw, where differences in the service’s responses are used as a side‑channel to enumerate user credentials, potentially exposing sensitive login information and enabling further credential‑based attacks if passwords are weak.

All models of the SonicWall SMA1000 series are affected; the advisory does not list specific firmware or model revisions, so any installed SMA1000 unit should be considered vulnerable until an official update is released.

The CVSS score of 7.2 places this issue in the high‑severity range, but the EPSS figure of less than 1% indicates that exploitation has not yet been observed or is rare. It is not listed in the CISA KEV catalog. Attackers are likely to use a remote, unauthenticated method that observes timing or content differences in server responses to enumerate usernames. If enumeration succeeds, valid usernames can be leveraged for further attacks, especially if passwords are weak or reused.