Measuring the SonicWall Edge: 15,608 WorkPlace Interfaces and the Limits of That Number

A recently discovered pre-authentication flaw in SonicWall's remote-access appliance has left defenders questioning how many of these devices are exposed. ZoomEye's search query for "WorkPlace" across the web has uncovered 15,608 potential targets. However, this figure is not definitive, as it encompasses all mentions of the SonicWall WorkPlace interface, not just the affected models.

SonicWall has deployed the WorkPlace portal across various product generations, and the title string does not specify the model or firmware version. Therefore, the count should not be interpreted as 15,608 vulnerable SMA 1000 appliances.

Despite this limitation, the 15,608 figure still provides valuable insight. It indicates that a significant number of SonicWall remote-access portals are accessible from the internet. For each device running an affected SMA 1000 firmware version, the server-side request forgery (SSRF) vulnerability can be exploited without proper credentials. Even among devices that have been patched, this vulnerability still poses a management surface that doesn't necessarily need to be publicly exposed.

The SMA 1000 has been plagued by multiple zero-day clusters in 2026, with CISA previously linking SMA 1000 exploitation to ransomware operations. This pattern is not unique to SonicWall, as remote-access appliances generally face unique challenges. These devices are designed to accept unauthenticated connections, terminate authenticated sessions, and sit within the network perimeter they are meant to protect.

An internet measurement platform cannot determine which of these appliances are properly patched. However, it can confirm that the population is large enough to be worth automating against, a conclusion that an attacker would also reach.

Defensively, the value of this data lies in its comparative and internal use. By querying "WorkPlace" restricted to your own address ranges and comparing the results with your asset inventory, you can identify appliances that are likely running outdated firmware. Appliances that appear in the query but not in the inventory are the most likely candidates for outdated firmware, as they are not being tracked.

For managed appliances, the recommended controls include keeping the management console off the public internet, requiring multi-factor authentication for administrative access, and monitoring appliance logs for authentication events that do not match known users.