CVE-2020-5135criticalunder attackransomwareCWE-120

CVE-2020-5135: critical vulnerability in SonicWall SonicOS

Published · Updated

Follow this CVE+ Monitor SonicOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 27%
from disclosure to weapon
Published on NVDOct 12
CISA KEV+519d
Action required by CISAfederal deadline: 2022-04-05

Apply updates per vendor instructions.

In short

A buffer overflow flaw in SonicOS firewalls allows attackers to crash the device or potentially run malicious code by sending specially crafted network requests. This affects multiple versions of SonicOS Gen 6 and Gen 7.

Technical detail

CWE-120 buffer overflow in SonicOS enables remote code execution or denial of service via malformed network requests to the firewall, with no authentication required. The vulnerability impacts SonicOS Gen 6 (versions 6.5.4.7, 6.5.1.12, 6.0.5.3, 6.5.4.v) and Gen 7 (7.0.0.0), presenting critical risk to exposed firewall instances.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnerability affected SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
SonicWall · SonicOS
Related CVEs — SonicWall SonicOS

In the same product, most dangerous first.

CVE-2024-53704HIGHCVE-2024-53704EPSS 95.3%KEVCVE-2024-40766CRITICALCVE-2024-40766EPSS 18.4%KEVCVE-2022-22274—CVE-2022-22274EPSS 75.5%CVE-2023-0656—CVE-2023-0656EPSS 41.3%CVE-2021-20031—CVE-2021-20031EPSS 13.0%CVE-2021-20048—CVE-2021-20048EPSS 2.0%