S0:E50: SonicWall's SMA 1000 Just Hit a CVSS 10 — And It's Already Being Exploited
SonicWall just disclosed a CVSS 10: a pre-authenticated — let's just call it unauthenticated — server-side request forgery (SSRF) in its SMA 1000 series, and it's already being exploited in the wild. Jess and Jake break down how an SSRF turns a trusted firewall into a "confused deputy," making requests on an attacker's behalf from inside your network, and why edge devices (Fortinet, Ivanti, NetScaler, and now SonicWall again) keep stacking up critical CVEs with patch cycles that can't keep pace. They also dig into log architecture: why dumping firewall logs into an expensive SIEM is often the…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.