CVE-2026-4116

Published: Apr 9, 2026Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication.

Affected (10)

Products: Sonicwall: Sma6210 Firmware, Sma6200 Firmware, Sma7200 Firmware, Sma7210 Firmware, Sma8200v

5 products

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sonicwall Sma6210 Firmware	Before 12.4.3-03387
Sonicwall Sma6210 Firmware	From 12.5.0 to 12.5.0-02624

Running on/with	Platform Versions
Sonicwall Sma6210	All versions

Configuration B

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sonicwall Sma6200 Firmware	Before 12.4.3-03387
Sonicwall Sma6200 Firmware	From 12.5.0 to 12.5.0-02624

Running on/with	Platform Versions
Sonicwall Sma6200	All versions

Configuration C

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sonicwall Sma7200 Firmware	Before 12.4.3-03387
Sonicwall Sma7200 Firmware	From 12.5.0 to 12.5.0-02624

Running on/with	Platform Versions
Sonicwall Sma7200	All versions

Configuration D

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sonicwall Sma7210 Firmware	Before 12.4.3-03387
Sonicwall Sma7210 Firmware	From 12.5.0 to 12.5.0-02624

Running on/with	Platform Versions
Sonicwall Sma7210	All versions

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Sonicwall Sma8200v	Before 12.4.3-03387
Sonicwall Sma8200v	From 12.5.0 to 12.5.0-02624

Related CWEs

CWE-176

Improper Handling of Unicode Encoding

The product does not properly handle when an input contains Unicode encoding.

References (1)

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0003

Source: PSIRT@sonicwall.com

Vendor Advisory

Timeline

No history available yet.