Executive Summary
SonicWall Global Management System (GMS) version 9.5.1 and earlier contains multiple vulnerabilities that, when chained, allow an unauthenticated remote attacker to gain root access to the appliance. Despite previous remediation attempts in version 9.5, researchers discovered that the underlying root causes for several critical flaws remained unaddressed, leading to effective patch bypasses. These flaws include a predictable authentication scheme, a path traversal bypass in ZIP file extraction, and insecure encryption of administrator password hashes.
The attack chain involves bypassing the 'Agent' user authentication using hardcoded cryptographic keys, exploiting a ZipSlip vulnerability to drop a JSP webshell, and potentially recovering the administrator password via offline dictionary attacks. Given that SonicWall GMS has reached End of Life (EoL) status as of September 2026, the severity of these bypasses is heightened for organizations that have not yet migrated to Network Security Manager (NSM).
Technical analysis reveals that the security controls were easily circumvented: the 'secret' for authentication is date-derived and statically recoverable, the path traversal filter can be bypassed by including the substring 'localdb' in filenames, and the password hash encryption key is derived from the hash it is intended to protect.