SonicWall SonicOS
At a glance
- Source
- NVD
- EPSS
- EPSS 18.38 % · percentile 97 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sonicwall
- NVD status
- Analyzed
Description
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
Weaknesses (CWE)
- CWE-284 — Improper Access Control
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L | CISA-ADP |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | CRITICAL 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2024-38613
- GCVE · GCVE-0-2024-40766
CERT-FR advisories
- CERTFR-2024-AVI-0712 — Vulnérabilité dans les produits Sonicwall · cert.ssi.gouv.fr
- CERTFR-2024-ALE-011 — Vulnérabilité dans SonicWall · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*< 5.9.2.14-13ocpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*< 6.5.2.8-2ncpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*< 6.5.4.15.116ncpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*≤ 7.0.1-5035
Affected products
| Product | Versions |
|---|---|
| SonicWall · SonicOS | affected 5.9.2.14-12o and older versions ; affected 6.5.4.14-109n and older versions ; affected 7.0.1-5035 and older versions |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |