CVE-2024-40766criticalunder attackransomwareCWE-284

CVE-2024-40766: critical vulnerability in SonicWall SonicOS

Published · Updated

Follow this CVE+ Monitor SonicOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has an official Brazilian government alert.

ssvc Actcvss 9.3epss 18%
from disclosure to weapon
Published on NVDAug 23
CISA KEV+17d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 19/2024Falha no controle de acesso de dispositivos SonicWallread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2024-09-30

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A flaw in SonicWall firewall management allows attackers to access restricted resources without proper authentication, and in certain cases, crash the firewall. This affects multiple generations of SonicWall devices running older SonicOS versions.

Technical detail

An improper access control vulnerability in SonicWall SonicOS management interface allows unauthenticated or insufficiently authenticated users to access protected resources. Under specific conditions, this can lead to denial of service through firewall crash. The vulnerability affects Gen 5, Gen 6, and Gen 7 devices running SonicOS 7.0.1-5035 or earlier.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Affected products
SonicWall · SonicOS
Related CVEs — SonicWall SonicOS

In the same product, most dangerous first.

CVE-2024-53704HIGHCVE-2024-53704EPSS 95.3%KEVCVE-2020-5135CRITICALCVE-2020-5135EPSS 26.9%KEVCVE-2026-19868HIGHCVE-2026-19868EPSS —KEVCVE-2022-22274—CVE-2022-22274EPSS 75.5%CVE-2023-0656—CVE-2023-0656EPSS 41.3%CVE-2021-20031—CVE-2021-20031EPSS 13.0%