SonicWall SMA 1000: Pre-Auth Deserialization RCE via Struts 1 Property Injection and Filter Rewrite

A pre-auth RCE chain on SonicWall SMA 1000 (12.4.2) combining a Struts 1 multipartRequestHandler property-injection flaw that rewrites Jetty auth filter mappings, an unauthenticated SSO admin token endpoint, and a Java deserialization sink in setStoredCommunity (BeanComparator + TemplatesImpl) to execute commands as mgmt-server — no credentials required.