CVE-2026-66149

CVE-2026-66149 is a command injection flaw (CWE-94) in the SonicWall Email Security appliance, in the network interface update routine (updateNetIf per the ZDI advisory) that handles the netmask parameter. An attacker who is already authenticated and has access to the appliance's restricted CLI can pass a malicious netmask value, causing arbitrary operating system commands to be injected and executed. Because the injected commands run as root, the attacker gains full privilege escalation from the limited CLI context to complete control of the appliance, with high impact on confidentiality, integrity, and availability. All organizations running the affected SonicWall Email Security appliance are exposed, though only to users or attackers who can already reach the restricted CLI, making this primarily a local privilege escalation rather than a remote attack. There is currently no known public proof-of-concept, no CISA KEV listing, and a low EPSS score of 0.2%, indicating no confirmed exploitation in the wild at this time.

What to do: Update SonicWall Email Security appliances to the fixed release identified in SonicWall's PSIRT advisory (version numbers not provided in the available data), prioritizing appliances where non-administrators or scripts have restricted-CLI access. Until patched, limit restricted-CLI access to trusted administrators only and audit local accounts and any automation that touches interface configuration. Since this requires local authenticated access and there is no known exploitation, treat it as a high-severity but routine patching item rather than an emergency.