SonicWall SMA 1000 — CVE-2026-83548 / CVE-2026-83549 Exposure Detector

A non-intrusive detection script for SonicWall Secure Mobile Access (SMA) 1000 series appliances affected by CVE-2026-83548 (pre-auth SSRF in the Work Place interface, CVSS 10.0) and CVE-2026-83549 (post-auth OS command injection in the AMC, CVSS 7.8) — two actively-exploited zero-days chained for unauthenticated RCE.

This is a patch-state / exposure check, not an exploit. It performs only read-only HTTP(S) GET requests, sends no SSRF or command-injection payload, and makes no authentication attempt. There is no proof-of-concept here.

What it does

1. Fetches the target's root page over HTTPS.
2. Fingerprints whether it is a SonicWall SMA 1000 WorkPlace portal (Server: SMA/*, __extraweb__ assets, SMA 1000 Series help link).
3. Extracts the firmware version the appliance advertises.
4. Compares it against SonicWall's published fixed builds and reports:
   • PATCHED — build ≥ the fixed build for its line.
   • AFFECTED — build < the fixed build (only when an exact build is exposed).
   • POTENTIALLY AFFECTED — on an affected firmware line but the exact hotfix build is not exposed externally (the common case — see limitation below).
   • NOT SMA 1000 — target doesn't look like an SMA 1000 WorkPlace portal.

Affected / fixed versions

Source: SonicWall product notice SNWLID-2026-0016. Affected hardware: SMA 1000 models 6210, 7210, 8200v.

Important limitation (read this)

An SMA 1000 typically advertises only its major.minor.patch line (e.g. 12.5.0) externally — not the exact hotfix build (e.g. 12.5.0-02902). Because the fixed build (12.5.0-02952) sits on the same 12.5.0 line as vulnerable builds, a target that exposes only 12.5.0 cannot be classified as patched-or-vulnerable from the outside. In that case the tool returns POTENTIALLY AFFECTED and tells you to confirm the exact build locally (appliance console / AMC). A "POTENTIALLY AFFECTED" result is not proof of vulnerability — the appliance may well be patched.

Usage

Requires Python 3.8+ (standard library only — no dependencies).

# Single target (verify the cert)
python3 sma1000_detect.py vpn.example.com

# By bare IP with a wildcard cert — skip cert verification
python3 sma1000_detect.py -k https://203.0.113.10

# Several targets, custom timeout
python3 sma1000_detect.py -t 10 host-a.example.com host-b.example.com

Example output:

[?] POTENTIALLY AFFECTED  https://vpn.example.com
        Server: SMA/12.5
        Version advertised: 12.5.0
        SMA 1000 on the 12.5.0 line, but the exact hotfix build is not exposed
        externally. This line contains BOTH vulnerable (< 12.5.0-02952) and patched
        (>= 12.5.0-02952) builds, so patch state is UNDETERMINED from outside. Verify
        the build locally (appliance console / AMC): confirm it is >= 12.5.0-02952.

Exit codes

Remediation

Upgrade to 12.4.3-03526 or 12.5.0-02952 (or later) per SonicWall's advisory. Because these CVEs are actively exploited in the wild, if an appliance was running a vulnerable build while internet-exposed, treat it as potentially compromised: check the vendor's indicators of compromise, and if any are present, reimage the appliance and reset all user/administrator passwords and TOTP/MFA credentials. Restrict AMC / management-plane access to trusted networks only.

References

• SonicWall Product Notice SNWLID-2026-0016
• CVE-2026-83548 — pre-auth SSRF, SMA 1000 Work Place interface (CVSS 10.0)
• CVE-2026-83549 — post-auth OS command injection, AMC (CVSS 7.8)
• CISA Known Exploited Vulnerabilities (KEV) catalog

Legal / authorized use

This tool is for authorized security testing and defensive patch-verification only. Run it only against systems you own or have explicit written permission to test. Unauthorized scanning may be illegal. The authors accept no liability for misuse. Provided under the MIT License — see LICENSE.