Improper handling of Unicode encoding in SonicWall SMA1000 series appliances enables a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication. This bug can allow an attacker who is already authenticated to substitute a malformed Unicode character and cause the system to skip the one‑time password challenge, granting unauthorized access and potentially exposing protected data. The weakness corresponds to CWE‑176 (Improper Encoding), and it directly undermines the confidentiality and integrity of user sessions.

The vulnerability affects all SonicWall SMA1000 appliances. No specific firmware versions are listed, so all current releases of the SMA1000 series should be considered at risk until a patch is applied.

The CVSS score of 7.2 indicates high severity, while an EPSS value below 1 % signals a low probability of widespread exploitation. The vulnerability is not yet listed in the CISA KEV catalog. The attack requires a malicious Unicode input designed to exploit the encoding flaw, and the attacker must already be authenticated via SSLVPN. Because the flaw directly bypasses the TOTP challenge, exploitation could lead to full session takeover if troubleshooting or administrative privileges are granted. The likely attack vector is remote authenticated—an attacker who can log into the SSLVPN can send the crafted Unicode payload and bypass the two‑factor step.