CVE-2026-4112

published 2026-04-09

CVE-2026-4112: Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote authenticated…

Priority P3 48 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote authenticated attacker with read-only administrator privileges to escalate privileges to primary administrator.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
sonicwall	sma	—	—
sonicwall	sma1000	—	—
sonicwall	sma1000	—	—
sonicwall	sma6200_firmware	< 12.4.3-03387	12.4.3-03387
sonicwall	sma6200_firmware	>= 12.5.0 < 12.5.0-02624	12.5.0-02624
sonicwall	sma6210_firmware	< 12.4.3-03387	12.4.3-03387
sonicwall	sma6210_firmware	>= 12.5.0 < 12.5.0-02624	12.5.0-02624
sonicwall	sma7200_firmware	< 12.4.3-03387	12.4.3-03387
sonicwall	sma7200_firmware	>= 12.5.0 < 12.5.0-02624	12.5.0-02624
sonicwall	sma7210_firmware	< 12.4.3-03387	12.4.3-03387
sonicwall	sma7210_firmware	>= 12.5.0 < 12.5.0-02624	12.5.0-02624
sonicwall	sma8200v	< 12.4.3-03387	12.4.3-03387
sonicwall	sma8200v	>= 12.5.0 < 12.5.0-02624	12.5.0-02624

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89