CVE-2020-5132

MEDIUM

SonicWall SMA100 Firmware and SonicOS - Exposure of Sensitive Internal Domain Names via SSL-VPN Authentication Page

Title source: llm
STIX 2.1

Description

SonicWall SSL-VPN products and SonicWall firewall SSL-VPN feature misconfiguration leads to possible DNS flaw known as domain name collision vulnerability. When the users publicly display their organization’s internal domain names in the SSL-VPN authentication page, an attacker with knowledge of internal domain names can potentially take advantage of this vulnerability.

References (1)

Core 1
Core References

Scores

CVSS v3 5.3
EPSS 0.0017
EPSS Percentile 38.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-200
Status published
Products (3)
sonicwall/sma100_firmware 10.2.0.2-20sv
sonicwall/sma100_firmware 12.4.0-2223
sonicwall/sonicos 6.5.4.6-79n
Published Sep 30, 2020
Tracked Since Feb 18, 2026