This vulnerability arises from improper handling of Unicode encoding in SonicWall SMA1000 appliances, enabling a remote authenticated SSLVPN administrator to bypass AMC TOTP authentication mechanisms. The affected versions include 12.4.3-03245 (platform-hotfix) and earlier, and 12.5.0-02283 (platform-hotfix) and earlier. The CVSS v3.1 base score is 6.6, reflecting a medium severity with high impact on confidentiality, integrity, and availability, but requiring high privileges and no user interaction. No vendor advisory or patch information is currently provided, and no known exploits have been reported.

An authenticated SSLVPN administrator can bypass the AMC TOTP multi-factor authentication, potentially allowing unauthorized access to administrative functions protected by TOTP. This could lead to compromise of confidentiality, integrity, and availability of the affected appliance. The vulnerability requires authenticated access with high privileges, limiting the attack surface to trusted users with SSLVPN admin rights.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should carefully control and monitor SSLVPN administrator access and consider additional compensating controls to protect against misuse of administrative credentials.