A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall

CVE-2026-0400 is a post-authentication format string flaw in SonicWall SonicOS that lets a remote attacker crash the firewall, i.e. a DoS against the security appliance itself. The CNA record lists affected versions as 7.0.1-5169 and older, 7.3.1-7013 and older, and 8.1.0-8017 and older; NVD later mapped vulnerable CPE ranges to builds before 7.3.2-7010 and before 8.2.0-8009 on covered Gen7/Gen8 platforms. SonicWall's 7.3.2 release notes explicitly mention SNWLID-2026-0001 as fixed there.

Reality check: this is not an edge pre-auth firewall disaster. The decisive friction is that exploitation is post-auth with high privileges, which implies the attacker already has admin-level reach into the management plane or equivalent access. The impact is real—crashing a perimeter firewall can hurt operations—but there is no public PoC, no KEV listing, low EPSS, and the blast radius is availability-only, so this lands at = ASSESSED AT MEDIUM.

Why this verdict

• High-privilege prerequisite cuts hard: this is not unauthenticated remote code execution; it requires authenticated, high-privilege access to the management plane, which implies prior compromise, insider position, or badly exposed admin access.
• Impact is availability-only: current public data supports a firewall crash, not code execution, data exposure, persistence, or tenant breakout.
• Exposure population is narrower than it looks: SonicWall appliances are common, but many enterprises keep management access on internal or trusted ranges, and MFA/IP restrictions should block the first step.
• Threat intel is quiet: no KEV, no confirmed public PoC, and very low EPSS all argue against treating this like an active edge emergency.
• Why not LOW: crashing a perimeter firewall still matters; on flat or poorly segmented shops with public management exposure, an attacker with admin access can cause visible business disruption quickly.

Why not higher?

To score higher, this would need at least one strong amplifier: pre-auth reach, broad public exploit availability, confirmed in-the-wild abuse, or impact beyond DoS. None of those showed up. The attack chain starts too far downfield—authenticated and high-privileged—to justify HIGH or CRITICAL.

Why not lower?

Calling this LOW would understate the fact that the target is the firewall itself, not a back-office app. Even a pure crash bug on a perimeter appliance can interrupt VPN, routing, inspection, or administration, especially in single-device deployments without clean HA.

1. Lock management to trusted networks — Restrict SonicOS management and API exposure to dedicated admin ranges or VPN-only paths. For a MEDIUM verdict there is no mitigation SLA — implement as practical while planning patching inside the 365-day remediation window, but do this sooner on any internet-reachable admin plane because it removes the key attacker prerequisite.
2. Enforce MFA for all admin-capable accounts — This vulnerability is post-authentication, so stronger identity control directly attacks the exploit chain. Require MFA on administrative access and privileged VPN identities; for MEDIUM, there is no mitigation SLA, but this is still the cleanest control improvement.
3. Cull stale admins and tokens — Review local admins, delegated admin roles, API users, and active sessions so an attacker has fewer ways to satisfy the high-privilege requirement. Fold this into your next credential hygiene cycle and complete it well before the 365-day remediation deadline.
4. Watch for firewall crash indicators — Alert on unexpected reboots, HA failovers, management-plane errors, and repeated admin/API requests from unusual sources. This will not prevent exploitation, but it shortens detection and containment when a crash attempt lands.
5. Validate HA behavior — If you run HA, confirm failover actually preserves traffic and management continuity under an unplanned active-node crash. That does not fix the bug, but it reduces business impact while you move through the remediation window.

Run this on an auditor workstation, jump host, or CI job, not on the firewall. Feed it a firmware string gathered from NSM, MySonicWall inventory, or SSH/GUI show version output; example: python3 check_cve_2026_0400.py 7.3.1-7013. No elevated OS privileges are needed—just the target version string.

#!/usr/bin/env python3
# check_cve_2026_0400.py
# Determine likely exposure to CVE-2026-0400 from a SonicOS version string.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / unable to classify

import re
import sys


def parse_version(v):
    m = re.match(r'^\s*(\d+)\.(\d+)\.(\d+)-(\d+)\s*$', v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def classify(vstr):
    v = parse_version(vstr)
    if v is None:
        return ("UNKNOWN", 2, "Version must look like 7.3.1-7013")

    # Best-available evidence used:
    # - CNA affected: 7.0.1-5169 and older; 7.3.1-7013 and older; 8.1.0-8017 and older
    # - NVD CPE mapping: vulnerable before 7.3.2-7010 and before 8.2.0-8009 on covered Gen7/Gen8 models
    # Because SonicWall branch entitlement / hotfix mapping is not fully machine-readable here,
    # some trains are intentionally reported as UNKNOWN rather than guessed.

    if v[0] == 7:
        # Explicitly affected older branch from CNA
        if v[:3] == (7, 0, 1):
            if v[3] <= 5169:
                return ("VULNERABLE", 1, "CNA lists 7.0.1-5169 and older as affected")
            return ("PATCHED", 0, "Later than 7.0.1-5169")

        # NVD maps affected 7.x covered models to < 7.3.2-7010
        if v[:2] == (7, 3):
            if cmp_ver(v, (7, 3, 2, 7010)) < 0:
                return ("VULNERABLE", 1, "NVD CPE mapping shows affected builds before 7.3.2-7010")
            return ("PATCHED", 0, "At or above 7.3.2-7010")

        # 7.1.x / 7.2.x not explicitly exposed in accessible advisory text
        return ("UNKNOWN", 2, "7.1.x / 7.2.x mapping not confirmed from accessible vendor text")

    if v[0] == 8:
        # NVD maps 8.x covered models to < 8.2.0-8009; CNA explicitly lists 8.1.0-8017 and older
        if cmp_ver(v, (8, 2, 0, 8009)) < 0:
            return ("VULNERABLE", 1, "NVD CPE mapping shows affected builds before 8.2.0-8009")
        return ("PATCHED", 0, "At or above 8.2.0-8009")

    return ("UNKNOWN", 2, "Major version not covered by reviewed advisory data")


def main():
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: python3 check_cve_2026_0400.py <version>")
        sys.exit(2)

    status, code, reason = classify(sys.argv[1])
    print(f"{status} - {reason}")
    sys.exit(code)


if __name__ == "__main__":
    main()

Sources

1. SonicWall PSIRT advisory SNWLID-2026-0001
2. NVD entry for CVE-2026-0400
3. SonicOS 7.3.2 release notes
4. Tenable Nessus plugin 300077
5. GreyNoise blog on scanning spikes preceding CVE-2026-0400
6. CISA Known Exploited Vulnerabilities catalog
7. FIRST EPSS project
8. CVE Details entry for EPSS percentile mirror