CVE-2024-53704: high-severity vulnerability in SonicWall SonicOS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A flaw in the SSL VPN login process allows attackers to skip authentication checks and gain unauthorized access to the VPN. This is critical because it lets intruders enter the system without a valid password or credentials.
An improper authentication vulnerability (CWE-287) in the SSLVPN mechanism permits remote attackers to bypass authentication controls without valid credentials. The attack vector is network-based with no authentication required, resulting in unauthorized access to protected resources and potential lateral movement within the network.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.