CVE-2024-12802: critical vulnerability in SonicWall SonicOS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
50Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck.
ssvc Actcvss 9.1epss 0.5%
from disclosure to weapon
Published on NVDJan 9
VulnCheck+495d
SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and potentially enabling attackers to bypass MFA by exploiting the alternative account name.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
SonicWall · SonicOSRelated CVEs — SonicWall SonicOS
In the same product, most dangerous first.