CVE-2026-107155

Summary

The SonicOS management interface contains a permissive cross-domain policy (CWE-942) that may allow unauthorized cross-origin requests under specific conditions. This could enable a remote unauthenticated attacker to trick a logged-in administrator into performing unintended actions via crafted web content.

Exploitability

Exploitation requires social engineering to诱导 an authenticated admin to visit a malicious site while logged into the SonicOS interface; no direct remote code execution or blind exploitation is possible.

Blast radius

If exploited, an attacker could potentially perform privileged administrative actions (e.g., configuration changes, credential resets) on the firewall without authentication, leading to full system compromise or service disruption.

Detection

Look for anomalous cross-origin requests from external domains to the SonicOS management endpoint (e.g., /cgi-bin/webapi) in web proxy logs, especially when accompanied by session cookies or authentication tokens; also monitor for unexpected POST/PUT requests originating from user sessions to sensitive management endpoints.

Prioritized remediation

No fixed version is published in the description; immediately restrict access to the SonicOS management interface to trusted IP ranges only and disable any unnecessary cross-origin resource sharing (CORS) headers via custom policy or firewall rules per vendor guidance.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.