This critical SSRF vulnerability in SonicWall SMA1000 appliances is confirmed to be under active exploitation in the wild and poses a severe risk of unauthorized internal network access.

The vulnerability is a Server-side request forgery (SSRF) located in the Work Place interface. It allows a remote, unauthenticated attacker to manipulate the appliance into sending requests to arbitrary internal or external locations.

Successful exploitation permits an attacker to bypass perimeter security, potentially accessing sensitive internal resources or services that are not exposed to the internet. Given the CVSS score of 10.0, this flaw represents a total compromise of the appliance, which could lead to lateral movement, data exfiltration, or complete system takeover.

Immediate Action: Apply the vendor-provided updates or mitigations detailed in the SonicWall PSIRT advisory immediately.

Proactive Monitoring: Monitor network logs for unusual outbound traffic originating from the SMA1000 appliance, particularly requests targeting internal IP addresses or sensitive local services.

Compensating Controls: Restrict access to the Work Place interface via IP whitelisting or VPN-only access until the patches are fully deployed.

Public Exploit Available: Yes, a public proof-of-concept exists via GitHub.

Due to confirmed active exploitation and the critical severity of this flaw, organizations must prioritize patching the SMA1000 appliances immediately. Ensure that all affected systems are updated to the vendor-recommended versions to neutralize this high-risk entry point.