{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4116", "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315", "state": "PUBLISHED", "assignerShortName": "sonicwall", "dateReserved": "2026-03-13T12:13:43.715Z", "datePublished": "2026-04-09T14:27:29.341Z", "dateUpdated": "2026-04-09T14:27:29.341Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315", "shortName": "sonicwall", "dateUpdated": "2026-04-09T14:27:29.341Z"}, "datePublic": "2026-04-09T05:11:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-176", "description": "CWE-176 Improper handling of unicode encoding", "type": "CWE"}]}], "affected": [{"vendor": "SonicWall", "product": "SMA1000", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "12.4.3-03245 (platform-hotfix) and earlier versions."}, {"status": "affected", "version": "12.5.0-02283 (platform-hotfix) and earlier versions."}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication.</p>"}]}], "references": [{"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0003", "tags": ["vendor-advisory"]}], "source": {"advisory": "SNWLID-2026-0003", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication."}], "id": "CVE-2026-4116", "lastModified": "2026-04-09T15:16:14.010", "metrics": {}, "published": "2026-04-09T15:16:14.010", "references": [{"source": "PSIRT@sonicwall.com", "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0003"}], "sourceIdentifier": "PSIRT@sonicwall.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-176"}], "source": "PSIRT@sonicwall.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,12.4.3-03245]"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,12.5.0-02283]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "SMA1000", "source": "cna", "vendor": "SonicWall"}, "product": "sma1000", "vendor": "sonicwall"}], "analysis": {"en": {"generated_at": "2026-04-09T16:27:45.629297+00:00", "value": {"mitigation_remediation": ["Apply the latest firmware update from SonicWall that addresses Unicode handling in SSLVPN.", "If a patch is not yet available, consider disabling the SSLVPN service or enforcing stricter authentication controls until the fix is released.", "Monitor VPN logs for abnormal authentication patterns that may indicate attempts to bypass TOTP."], "summary": {"action": "Apply Patch", "impact": "Authentication Bypass (TOTP)"}, "threat_synthesis": {"affected_systems": "SonicWall SMA1000 series appliances are affected. No specific firmware or model numbers are listed in the advisory, but any device within the SMA1000 line is potentially vulnerable.", "description_and_impact": "The vulnerability arises from improper handling of Unicode encoding within the SonicWall SMA1000 SSLVPN service, enabling a remote authenticated user to bypass the required TOTP challenge for the Workplace/Connect tunnel. By exploiting this flaw, an attacker who already holds basic login credentials can circumvent the second\u2011factor authentication and gain full access to the protected network resources, effectively compromising the integrity of the authentication process.", "risk_and_exploitability": "The CVSS score and EPSS are not provided, so the quantified severity is unknown. However, the flaw can be triggered remotely by an authenticated SSLVPN user, which suggests a high likelihood of exploitation in environments where TOTP is the primary defense. Since the vulnerability allows abuse of existing credentials to bypass an additional factor, its impact on confidentiality and integrity is significant, especially in networks relying on double\u2011factor authentication for secure access."}}}}, "created": "2026-04-10T08:53:34.939191+00:00", "title": "Bypass of TOTP Authentication via Unicode Exploit in SonicWall SMA1000 SSLVPN", "updated": "2026-04-10T09:32:46.973657+00:00", "vendors": ["sonicwall", "sonicwall$PRODUCT$sma1000"]}