Authenticated Arbitrary File Upload in SonicWall SMA 100 Series Web Management Interface

Successful exploitation can allow an attacker with administrative access to write arbitrary files to the appliance and potentially escalate that access to remote code execution on the underlying system. This can result in full compromise of the appliance, persistent access, theft of credentials and other sensitive configuration material, manipulation of remote access services, and use of the device as a foothold for follow-on intrusion activity.

Reduce exposure of the management plane by disabling remote management on external-facing interfaces where practical. Enforce MFA for all users and administrators, enable the Web Application Firewall, restrict administrative access to trusted networks, and harden the appliance in accordance with vendor guidance. If compromise is suspected, reset credentials, rebind OTP or MFA secrets, inspect the appliance for unauthorized modifications, and consider migration to a supported platform because SMA 100 support has ended.

Upgrade affected SonicWall SMA 100 Series appliances to a fixed firmware release. The available reporting indicates SonicWall addressed the issue in the 10.2.2.x branch, including version 10.2.2.1-90sv, and later guidance also recommends upgrading to 10.2.2.2-92sv for affected SMA 210, SMA 410, and SMA 500v deployments. For SMA 500v, rebuild the virtual appliance from a clean new OVA, restore only trusted configuration data, and remove prior disks and snapshots as part of recovery if compromise is suspected. After patching, rotate administrative and user passwords, reinitialize OTP bindings or MFA tokens, and review logs and connection history for signs of unauthorized access.