An improper access control flaw exists in the export settings of SonicWall Network Security Manager on‑prem, allowing authenticated attackers to retrieve sensitive configuration information. The flaw may enable privilege escalation to an administrator or enable interception of communications between other users, threatening confidentiality and potentially integrity. This vulnerability is identified as CWE‑863.

SonicWall Network Security Manager (NSM). No specific version details are provided, so all on‑prem deployments of NSM may be affected. The issue pertains specifically to the export configuration functionality.

Exploitation likelihood is unknown due to the absence of an EPSS score, and the vulnerability is not listed in CISA KEV, indicating no documented exploitation activity. The flaw requires remote authenticated access, meaning an attacker with valid credentials can exploit it. While the lack of public exploits reduces immediate risk, the potential for privilege escalation and information disclosure warrants prompt remediation. The CVSS severity is not disclosed in the data but is expected to be high given the nature of the flaw.