SonicWall SonicOS
En bref
- Source
- NVD
- EPSS
- EPSS 18.38 % · centile 97 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sonicwall
- Statut NVD
- Analyzed
Description
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
Faiblesses (CWE)
- CWE-284 — Contrôle d'accès incorrect
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L | CISA-ADP |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | CRITICAL 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2024-38613
- GCVE · GCVE-0-2024-40766
Avis du CERT-FR
- CERTFR-2024-AVI-0712 — Vulnérabilité dans les produits Sonicwall · cert.ssi.gouv.fr
- CERTFR-2024-ALE-011 — Vulnérabilité dans SonicWall · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*< 5.9.2.14-13ocpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*< 6.5.2.8-2ncpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*< 6.5.4.15.116ncpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*≤ 7.0.1-5035
Produits affectés
| Produit | Versions |
|---|---|
| SonicWall · SonicOS | affected 5.9.2.14-12o and older versions ; affected 6.5.4.14-109n and older versions ; affected 7.0.1-5035 and older versions |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |