Information Disclosure via Response Discrepancy in SonicWall SMA1000 SSL VPN

Publication date: 2026-04-09

Last updated on: 2026-04-13

Assigner: SonicWALL, Inc.

Description

An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-09

Last Modified

2026-04-13

Generated

2026-07-06

AI Q&A

2026-04-09

EPSS Evaluated

2026-07-05

NVD

CVE-2026-4113

EUVD

EUVD-2026-20904

Affected Vendors & Products

Vendor	Product	Version / Range
sonicwall	sma1000	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-204	The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability is an observable response discrepancy in the SonicWall SMA1000 series appliances. It allows a remote attacker to enumerate SSL VPN user credentials by analyzing differences in the appliance's responses.

Impact Analysis

The vulnerability can impact you by enabling a remote attacker to discover SSL VPN user credentials. This could lead to unauthorized access to your VPN, potentially compromising sensitive data and network security.

Hi! I’m here to help you understand CVE-2026-4113. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70