The vulnerability arises from improper handling of Unicode encoding within the SonicWall SMA1000 SSLVPN service, enabling a remote authenticated user to bypass the required TOTP challenge for the Workplace/Connect tunnel. By exploiting this flaw, an attacker who already holds basic login credentials can circumvent the second‑factor authentication and gain full access to the protected network resources, effectively compromising the integrity of the authentication process.

SonicWall SMA1000 series appliances are affected. No specific firmware or model numbers are listed in the advisory, but any device within the SMA1000 line is potentially vulnerable.

The CVSS score and EPSS are not provided, so the quantified severity is unknown. However, the flaw can be triggered remotely by an authenticated SSLVPN user, which suggests a high likelihood of exploitation in environments where TOTP is the primary defense. Since the vulnerability allows abuse of existing credentials to bypass an additional factor, its impact on confidentiality and integrity is significant, especially in networks relying on double‑factor authentication for secure access.