CVE-2026-4112

HIGH

SonicWall SMA1000 SQL Injection Privilege Escalation

Generated titleSource: EIP title enrichment
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-4112 has a selected CVSS score of 7.2 (high); EIP currently links 1 repository PoC.

Description

Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote authenticated attacker with read-only administrator privileges to escalate privileges to primary administrator.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 10, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

SMA1000

Browse SonicWall / SMA1000

Default status: unknown

CVE List12.4.3-03245 (platform-hotfix) and earlier versions.affected
12.5.0-02283 (platform-hotfix) and earlier versions.affected

Proofs of concept

1

Repository PoCs

GitHubHann1bl3L3ct3r/CVE-2026-4112Repository PoCby Hann1bl3L3ct3r0Exploit2 files

51.2 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script (sma_admin_hash_poc.py) that automates the full exploitation chain for CVE-2026-4112: authenticates to the SonicWall SMA management console, exploits a blind SQL injection to read the avconfig.xml file via LOAD_FILE, and extracts the primary administrator's SHA-512 password hash character by character.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README.md documentation file and a Python proof-of-concept script (sma_admin_hash_poc.py) for CVE-2026-4112. The script performs a documented privilege escalation chain: authentication, blind SQL injection, file read via LOAD_FILE, and hash extraction. No concealed backdoor, deceptive payload, or unrelated harmful behavior was observed. The script's actions are consistent with its stated purpose of extracting a password hash for cracking.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagespython
Target softwareSonicWall SMA 1000 series
Attack typessql injectionprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script is a fully automated tool that exercises the SQL injection vulnerability to extract sensitive data (the admin password hash) from the target system. It does not merely check for the vulnerability's existence; it actively exploits it to achieve a specific malicious outcome (privilege escalation via credential extraction).

sma_admin_hash_poc.py:1-50sma_admin_hash_poc.py:218-279sma_admin_hash_poc.py:516-550

Requirements

  • Valid management console credentials (any role, including read-only)sma_admin_hash_poc.py:132-145
  • Network access to the SMA management console on port 8443sma_admin_hash_poc.py:146-148

Observed behavior

  • Authenticates to the management console using provided credentials and realm, extracting a CSRF token and obtaining a JSESSIONID cookie.sma_admin_hash_poc.py:132-211
  • Sends a POST request to /activeUsers.action with a crafted realmFilter containing a trailing backslash and a communityFilter containing a time-based blind SQL injection payload.sma_admin_hash_poc.py:218-279
  • Uses the SQL injection to execute LOAD_FILE() to read the avconfig.xml configuration file, locates the admin password hash using SQL string functions, and extracts it character by character via binary search over ASCII values.sma_admin_hash_poc.py:370-421sma_admin_hash_poc.py:282-315
  • Outputs the extracted SHA-512 crypt hash in hashcat-compatible format and optionally invokes hashcat to crack the password.sma_admin_hash_poc.py:557-656
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Exfiltration
Extracts SHA-512 password hash from avconfig.xmlThe script's primary function is to extract the admin password hash, which is the stated goal of the PoC for CVE-2026-4112. This is not a backdoor but the documented exploit behavior.sma_admin_hash_poc.py:516-550
Remote Code Execution
Executes hashcat subprocess to crack extracted hashThe script optionally runs hashcat as a subprocess to crack the extracted hash. This is an advertised feature (--crack flag) and directly supports the PoC's goal of demonstrating full compromise.sma_admin_hash_poc.py:576-656
Review boundaries

What the analysis did not establish

  • Evidence consists of the README.md writeup and the sma_admin_hash_poc.py script. No network traffic, execution logs, or target system responses are included to independently verify the exploit's success.
  • The analysis is based solely on the supplied source code and documentation; the code was not executed, and its effectiveness against a live target is not confirmed by the evidence.
  • Only the two text files (README.md and sma_admin_hash_poc.py) were reviewed. No binary files were present in the evidence packet.
  • The review does not assess the safety of executing the script against a live target, only whether the script itself contains backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2