CVE-2023-0126: Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and…

PriorityP180high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EXPLOIT

EPSS

72.70%

99.4th percentile

Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
sonicwall	sma1000_firmware	—	—
sonicwall	sonicwall_sma1000	—	—

Detection & IOCsextracted from sources · hover to see the quote

url/images//////////////////../../../../../../../../etc/passwd

port8443

path/images/

snort

alert http any any -> $HOME_NET 8443 (msg:"ET WEB_SPECIFIC_APPS SonicWall SMA1000 Directory Traversal Attempt (CVE-2023-0126)"; flow:established,to_server; http.request_line; content:"GET /images/"; fast_pattern; startswith; pcre:"/^.{0,30}(?:(?:\x2e|%2[Ee]){1,2}(?:\x2f|\x5c|%5[Cc]|%2[Ff]){1,}){2,}/R"; reference:url,github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0126.yaml; reference:cve,2023-0126; classtype:attempted-recon; sid:2056308; rev:2; metadata:affected_product SonicWall, created_at 2024_09_27, cve CVE_2023_0126, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery; target:dest_ip;)

→Match HTTP GET requests beginning with '/images/' followed by path traversal sequences (dot-dot-slash variants including URL-encoded forms) to detect exploitation attempts against SonicWall SMA1000.
→Successful exploitation response contains the string matching 'root:[x*]:0:0' in the body (contents of /etc/passwd) with HTTP 200 status and 'content/unknown' in the response header.
→Use Shodan query 'title:"Appliance Management Console Login"' or FOFA query 'title="appliance management console login"' to identify exposed SonicWall SMA1000 devices for proactive asset discovery.
→The vulnerability is pre-authentication (no credentials required), so any unauthenticated request to the traversal path is a strong indicator of exploitation. ↗

·The Snort/ET rule targets port 8443 specifically ($HOME_NET 8443); if the SMA1000 management console is exposed on a non-standard port, the rule must be adjusted accordingly.
·The Nuclei template response matcher checks for 'content/unknown' in the response header as a fingerprint; this header value is device-specific and may vary across firmware builds or configurations.
·This vulnerability is confirmed only in SMA1000 firmware version 12.4.2; detections should be scoped to that specific version where version fingerprinting is possible. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.