Improper Unicode Handling in SonicWall Appliances Exposes VPN Authentication Risks
CVE-2026-4114

Currently unrated

Key Information:

Vendor

Sonicwall
Status
Sma1000
Vendor
CVE Published:
9 April 2026

What is CVE-2026-4114?

A critical vulnerability exists in SonicWall SMA1000 series appliances due to improper handling of Unicode encoding. This flaw allows a remote authenticated SSLVPN administrator to bypass the Time-based One-Time Password (TOTP) authentication mechanism, potentially compromising the security of the administration interface. The exploitation of this vulnerability poses a significant risk, enabling unauthorized access to sensitive management functions within the appliance.

Affected Version(s)

SMA1000 Linux 12.4.3-03245 (platform-hotfix) and earlier versions.

SMA1000 Linux 12.5.0-02283 (platform-hotfix) and earlier versions.

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-202...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.