2 min read
Two SonicWall SMA1000 bugs chain into unauthenticated RCE — and they're already being exploited
A CVSS 10.0 pre-auth SSRF plus a post-auth RCE add up to full compromise of an internet-facing VPN appliance. Patched versions exist; CISA's remediation deadline has already passed.