CVE-2024-40766KEV · OVERDUECWE-284broken-access-control

SonicWall SonicOS Improper Access Control Vulnerability

Critical · published August 23, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 97.2th percentile for exploit probability.

754
days past CISA
deadline
CVSS v3.1
9.8
EPSS
18%
Percentile
97.2
In the wild
Confirmed
What it is

🚨 An improper access control flaw in SonicWall SonicOS could let unauthorized users waltz right in and access sensitive resources! 🔥 Think of it like a security guard at a club who just lets anyone through the ropes without checking IDs. In this case, the firewall acts like that careless bouncer, risking a complete shutdown when the wrong people gain access. If exploited, this vulnerability could lead to a breach of sensitive information, potentially allowing attackers to take control of critical systems or even crash the firewall entirely. This could result in devastating downtime and loss of access to vital resources, putting your entire network at risk.

Put simply

Think of it like a security guard at a club who just lets anyone through the ropes without checking IDs. In this case, the firewall acts like that careless bouncer, risking a complete shutdown when the wrong people gain access. This vulnerability arises from improper access control mechanisms in SonicWall SonicOS, affecting Gen 5, Gen 6, and Gen 7 devices running versions 7.0.1-5035 and older, allowing unauthorized access under certain conditions.

What to do

If exploited, this vulnerability could lead to a breach of sensitive information, potentially allowing attackers to take control of critical systems or even crash the firewall entirely. This could result in devastating downtime and loss of access to vital resources, putting your entire network at risk. It's crucial to update your SonicWall devices immediately to the latest version to close this security gap. Ensure your firewall is set to enforce strict access controls and review and adjust your security policies as necessary. You've got this! Stay vigilant, patch those devices, and keep your network safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.18379 · 97.2th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-08-23T11:15Z
KEV added
2024-09-09 · due 2024-09-30
Affected products (4)
ProductVersionsFixed in
sonicwall/sonicos< 5.9.2.14-13o5.9.2.14-13o
sonicwall/sonicos< 6.5.2.8-2n6.5.2.8-2n
sonicwall/sonicos< 6.5.4.15.116n6.5.4.15.116n
sonicwall/sonicos≤ 7.0.1-5035—
References (2)
EPSS history
Timeline
  • 09 SEP 00:00Z
    Added to CISA KEV — remediate by Sep 30
    kev
  • 23 AUG 06:19Z
    An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access…
    cvelistv5