Description

Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T21:17:49.497Z",
  "pubdate": "2026-08-11T21:17:49.497Z",
  "executiveSummary": "An Improper Control of Generation of Code ('Code Injection') vulnerability has been identified in the SonicWall Email Security appliance. The vulnerability arises from inadequate input sanitization within the restricted Command Line Interface (CLI) related to Simple Network Management Protocol (SNMP) configurations.\nSuccessful exploitation of this vulnerability allows an authenticated attacker who has access to the SonicWall Email Security restricted CLI to inject arbitrary operating system commands. These injected commands execute with elevated privileges, specifically as the root user, leading to a complete compromise of the underlying host operating system.\nThe attack vector requires prior authentication and access to the restricted CLI interface, limiting unauthenticated remote exploitation. However, the risk implications are severe due to the potential for full root-level control, unauthorized modification of system settings, potential data exfiltration, and full system takeover.\nOrganizations deploying the affected SonicWall Email Security appliance must carefully manage CLI access credentials and monitor for unauthorized administrative actions while awaiting official vendor patches or configuration-based workarounds.",
  "technicalDetails": "The vulnerability is classified under CWE-94: Improper Control of Generation of Code ('Code Injection'). The affected component is the restricted Command Line Interface (CLI) of the SonicWall Email Security appliance, specifically within the subsystem handling SNMP parameter configuration and execution.\nThe root cause of the vulnerability stems from the application's failure to adequately validate, sanitize, or escape user-supplied input provided through the restricted CLI. When an authenticated user submits crafted input intended for SNMP configuration routines, the underlying application logic insecurely concatenates or passes this input to the underlying operating system shell or command interpreter without sufficient neutralization of meta-characters.\nThe attack flow proceeds in several sequential stages. First, the attacker must authenticate to the SonicWall Email Security restricted CLI using valid credentials. Second, the attacker navigates to the vulnerable SNMP configuration interface or command context. Third, the attacker inputs a specially crafted payload containing arbitrary operating system commands disguised as valid SNMP parameters or identifiers. Fourth, the application processes the input and executes the injected string via the system shell. Finally, because the affected process runs with administrative privileges, the injected commands execute as root, granting the attacker total control over the appliance.\nPrerequisites for exploitation include valid authentication credentials to the restricted CLI interface. The network exposure is dictated by the accessibility of the CLI, which may be exposed via secure shell (SSH) or serial console depending on device configuration. The payload behavior involves direct execution of arbitrary OS commands in the security context of the root user, enabling post-exploitation activities such as persistence establishment, credential harvesting, lateral movement, and disabling security logging mechanisms."
}