{"id":"CVE-2026-107155","published":"2026-11-06T19:17:06.623","lastModified":"2026-11-07T05:18:00.190","description":"A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-942"],"vendors":[],"products":[],"references":[{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The SonicOS management interface contains a permissive cross-domain policy (CWE-942) that may allow unauthorized cross-origin requests under specific conditions. This could enable a remote unauthenticated attacker to trick a logged-in administrator into performing unintended actions via crafted web content.","exploitability":"Exploitation requires social engineering to诱导 an authenticated admin to visit a malicious site while logged into the SonicOS interface; no direct remote code execution or blind exploitation is possible.","blast_radius":"If exploited, an attacker could potentially perform privileged administrative actions (e.g., configuration changes, credential resets) on the firewall without authentication, leading to full system compromise or service disruption.","remediation":"No fixed version is published in the description; immediately restrict access to the SonicOS management interface to trusted IP ranges only and disable any unnecessary cross-origin resource sharing (CORS) headers via custom policy or firewall rules per vendor guidance.","detection":"Look for anomalous cross-origin requests from external domains to the SonicOS management endpoint (e.g., /cgi-bin/webapi) in web proxy logs, especially when accompanied by session cookies or authentication tokens; also monitor for unexpected POST/PUT requests originating from user sessions to sensitive management endpoints.","tags":["cors-misconfig","csrf","web-interface","privilege-escalation","social-engineering"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:51:32.602Z"}}