SonicWall SonicOS
68 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-0516 | 6.5.5.2-28n and older versions ; 7.0.1-5169 and older versions ; 7.3.3-7015 and older versions ; … | A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-0206 | 6.5.5.1-6n and older versions ; 7.0.1-5169 and older versions ; 7.3.1-7013 and older versions ; … | A post-authentication Stack-based Buffer Overflow vulnerabilities in SonicOS allows a remote attacker to crash a firewall. | MEDIUM 4.9 | 0.5 % | ||
| CVE-2026-0205 | 6.5.5.1-6n and older versions ; 7.0.1-5169 and older versions ; 7.3.1-7013 and older versions ; … | A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services. | MEDIUM 6.8 | 0.4 % | ||
| CVE-2026-0204 | 6.5.5.1-6n and older versions ; 7.0.1-5169 and older versions ; 7.3.1-7013 and older versions ; … | A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific | HIGH 8.0 | 0.4 % | ||
| CVE-2026-3439 | 7.0.1-5169 and older versions ; 7.3.1-7013 and older versions ; 8.1.0-8017 and older versions | A post-authentication Stack-based Buffer Overflow vulnerability in SonicOS certificate handling allows a remote attacker to crash a firewall | MEDIUM 4.9 | 0.3 % | ||
| CVE-2026-0402 | 7.0.1-5169 and older versions ; 7.3.1-7013 and older versions ; 8.1.0-8017 and older versions | A post-authentication Out-of-bounds Read vulnerability in SonicOS allows a remote attacker to crash a firewall. | MEDIUM 4.9 | 0.4 % | ||
| CVE-2026-0401 | 7.0.1-5169 and older versions ; 7.3.1-7013 and older versions ; 8.1.0-8017 and older versions | A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall. | MEDIUM 4.9 | 0.4 % | ||
| CVE-2026-0400 | 7.0.1-5169 and older versions ; 7.3.1-7013 and older versions ; 8.1.0-8017 and older versions | A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall. | MEDIUM 4.9 | 0.5 % | ||
| CVE-2026-0399 | 7.0.1-5169 and older versions ; 7.3.1-7013 and older versions ; 8.1.0-8017 and older versions | Multiple post-authentication stack-based buffer overflow vulnerabilities in the SonicOS management interface due to improper bounds checking | MEDIUM 4.9 | 0.4 % | ||
| CVE-2025-40601 | 7.3.0-7012 and older versions ; 8.0.2-8011 and older versions | A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Servic | HIGH 7.5 | 0.9 % | ||
| CVE-2025-40600 | 7.2.0-7015 and older versions | Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause | CRITICAL 9.8 | 1.0 % | ||
| CVE-2025-32818 | 7.1.1-7040 – 7.1.3-7015 ; 8.0.0-8037 and earlier versions | A Null Pointer Dereference vulnerability in the SonicOS SSLVPN Virtual office interface allows a remote, unauthenticated attacker to crash t | HIGH 7.5 | 0.8 % | ||
| CVE-2024-12802 | 6.5.4.4-44v-21-2457 and older versions ; 6.5.4.15-117n and older versions ; 7.0.1-5161 and older versions ; … | SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Secur | CRITICAL 9.1 | 0.5 % | ||
| CVE-2024-12806 | 6.5.4.15-117n and older versions ; 7.0.1-5161 and older version ; 7.1.2-7019 ; … | A post-authentication absolute path traversal vulnerability in SonicOS management allows a remote attacker to read an arbitrary file. | MEDIUM 4.9 | 0.7 % | ||
| CVE-2024-12805 | 6.5.4.15-117n and older versions ; 7.0.1-5161 and older version ; 7.1.2-7019 ; … | A post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads t | HIGH 7.2 | 0.7 % | ||
| CVE-2024-12803 | 6.5.4.15-117n and older versions ; 7.0.1-5161 and older version ; 7.1.2-7019 ; … | A post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remote attacker to crash a firewall and poten | HIGH 7.2 | 0.8 % | ||
| CVE-2024-40765 | 6.5.4.4-44v-21-2395 and older versions ; 7.0.1-5151 and older versions ; 7.1.1-7051 and older versions | An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of S | CRITICAL 9.8 | 0.8 % | ||
| CVE-2024-53706 | 7.1.1-7058 and older versions ; 7.1.2-7019 | A vulnerability in the Gen7 SonicOS Cloud platform NSv, allows a remote authenticated local low-privileged attacker to elevate privileges to | HIGH 7.8 | 0.3 % | ||
| CVE-2024-53705 | 6.5.4.15-117n and older versions ; 7.0.1-5161 and older versions ; 7.1.1-7058 and older versions ; … | A Server-Side Request Forgery vulnerability in the SonicOS SSH management interface allows a remote attacker to establish a TCP connection t | HIGH 7.5 | 0.7 % | ||
| CVE-2024-53704 | 7.1.1-7058 and older versions ; 7.1.2-7019 ; 8.0.0-8035 | An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. | CRITICAL 9.8 | 95 % | KEV | |
| CVE-2024-40762 | 7.1.1-7058 and older versions ; 7.1.2-7019 ; 8.0.0-8035 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generator that, in certain ca | CRITICAL 9.8 | 1.0 % | ||
| CVE-2024-40766 | 5.9.2.14-12o and older versions ; 6.5.4.14-109n and older versions ; 7.0.1-5035 and older versions | An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized | CRITICAL 9.8 | 18 % | KEV | |
| CVE-2024-40764 | 6.5.4.4-44v-21-2395 and older versions ; 7.0.1-5151 and older versions ; 7.1.1-7051 and older versions | Heap-based buffer overflow vulnerability in the SonicOS IPSec VPN allows an unauthenticated remote attacker to cause Denial of Service (DoS) | HIGH 7.5 | 0.7 % | ||
| CVE-2024-29013 | 7.1.1-7051 and earlier versions | Heap-based buffer overflow vulnerability in the SonicOS SSL-VPN allows an authenticated remote attacker to cause Denial of Service (DoS) via | MEDIUM 6.5 | 0.6 % | ||
| CVE-2024-29012 | 7.1.1-7051 and earlier versions | Stack-based buffer overflow vulnerability in the SonicOS HTTP server allows an authenticated remote attacker to cause Denial of Service (DoS | HIGH 7.5 | 0.5 % | ||
| CVE-2024-22397 | 7.0.1-5145 and earlier versions ; 7.1.1-7047 and earlier versions | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the SonicOS SSLVPN portal allows a remote authentica | HIGH 8.3 | 1.1 % | ||
| CVE-2024-22396 | 7.0.1-5145 and earlier versions ; 7.1.1-7047 and earlier versions ; 6.5.4.13-105n and earlier versions ; … | An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of S | MEDIUM 5.3 | 1.1 % | ||
| CVE-2024-22394 | SonicOS 7.1.1-7040 | An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific conditions could allow | CRITICAL 9.8 | 0.7 % | ||
| CVE-2023-41715 | 7.0.1-5119 and earlier versions ; 7.0.1-5129 and earlier versions ; 6.5.4.4-44v-21-2079 and earlier versions ; … | SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privileg | HIGH 8.8 | 0.8 % | ||
| CVE-2023-41713 | 7.0.1-5119 and earlier versions ; 7.0.1-5129 and earlier versions ; 6.5.4.4-44v-21-2079 and earlier versions ; … | SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function. | HIGH 7.5 | 0.7 % | ||
| CVE-2023-41712 | 7.0.1-5119 and earlier versions ; 7.0.1-5129 and earlier versions ; 6.5.4.4-44v-21-2079 and earlier versions ; … | SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the SSL VPN plainprefs.exp URL endpoint leads to a firewall crash. | MEDIUM 6.5 | 1.0 % | ||
| CVE-2023-41711 | 7.0.1-5119 and earlier versions ; 7.0.1-5129 and earlier versions ; 6.5.4.4-44v-21-2079 and earlier versions ; … | SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the sonicwall.exp, prefs.exp URL endpoints lead to a firewall crash | MEDIUM 6.5 | 1.0 % | ||
| CVE-2023-39280 | 7.0.1-5119 and earlier versions ; 7.0.1-5129 and earlier versions ; 6.5.4.4-44v-21-2079 and earlier versions ; … | SonicOS p ost-authentication Stack-Based Buffer Overflow vulnerability in the ssoStats-s.xml, ssoStats-s.wri URL endpoints leads to a firew | MEDIUM 6.5 | 1.0 % | ||
| CVE-2023-39279 | 7.0.1-5119 and earlier versions ; 7.0.1-5129 and earlier versions ; 6.5.4.4-44v-21-2079 and earlier versions ; … | SonicOS post-authentication Stack-Based Buffer Overflow vulnerability in the getPacketReplayData.json URL endpoint leads to a firewall crash | MEDIUM 6.5 | 1.0 % | ||
| CVE-2023-39278 | 7.0.1-5119 and earlier versions ; 7.0.1-5129 and earlier versions ; 6.5.4.4-44v-21-2079 and earlier versions ; … | SonicOS post-authentication user assertion failure leads to Stack-Based Buffer Overflow vulnerability via main.cgi leads to a firewall crash | MEDIUM 6.5 | 1.0 % | ||
| CVE-2023-39277 | 7.0.1-5119 and earlier versions ; 7.0.1-5129 and earlier versions ; 6.5.4.4-44v-21-2079 and earlier versions ; … | SonicOS post-authentication stack-based buffer overflow vulnerability in the sonicflow.csv and appflowsessions.csv URL endpoints leads to a | MEDIUM 6.5 | 1.0 % | ||
| CVE-2023-39276 | 7.0.1-5119 and earlier versions ; 7.0.1-5129 and earlier versions ; 6.5.4.4-44v-21-2079 and earlier versions ; … | SonicOS post-authentication stack-based buffer overflow vulnerability in the getBookmarkList.json URL endpoint leads to a firewall crash. | MEDIUM 6.5 | 1.0 % | ||
| CVE-2023-1101 | SonicOS 6.5.4.11-97n and earlier ; SonicOS NSv 6.5.4.4-44v-21-1551 and earlier ; SonicOS NSsp 7.0.1-5083 and earlier ; … | SonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated attacker to use excessive MFA codes. | HIGH 8.8 | 0.7 % | ||
| CVE-2023-0656 | SonicOS NSv 6.5.4.4-44v-21-1551 and earlier ; SonicOS NSsp 7.0.1-5083 and earlier ; SonicOS 7.0.1-5095 and earlier | A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS), which | HIGH 7.5 | 41 % | ||
| CVE-2022-22278 | SonicOS Gen 7 TZ-Series 7.0.1-5030-R2007 and earlier versions. ; SonicOS Gen 7 NSa-Series 7.0.1-5030-R2007 and earlier versions. ; SonicOS Gen 7 NSv-Series 7.0.1.0-5030-1391 and earlier versions. ; … | A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when us | HIGH 7.5 | 1.0 % | ||
| CVE-2022-22277 | SonicOS Gen 7 TZ-Series 7.0.1-5030-R2007 and earlier versions. ; SonicOS Gen 7 NSa-Series 7.0.1-5030-R2007 and earlier versions. ; SonicOS Gen 7 NSv-Series 7.0.1.0-5030-1391 and earlier versions. ; … | A vulnerability in SonicOS SNMP service resulting exposure of Wireless Access Point sensitive information in cleartext. | MEDIUM 5.3 | 0.8 % | ||
| CVE-2022-22276 | SonicOS Gen 7 TZ-Series 7.0.1-5030-R2007 and earlier versions. ; SonicOS Gen 7 NSa-Series 7.0.1-5030-R2007 and earlier versions. ; SonicOS Gen 7 NSv-Series 7.0.1.0-5030-1391 and earlier versions. ; … | A vulnerability in SonicOS SNMP service resulting exposure of sensitive information to an unauthorized user. | MEDIUM 5.3 | 0.8 % | ||
| CVE-2022-22275 | SonicOS Gen 7 TZ-Series 7.0.1-5030-R2007 and earlier versions. ; SonicOS Gen 7 NSa-Series 7.0.1-5030-R2007 and earlier versions. ; SonicOS Gen 7 NSv-Series 7.0.1.0-5030-1391 and earlier versions. ; … | Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy until TCP handshake po | HIGH 7.5 | 1.1 % | ||
| CVE-2022-22274 | SonicOS 7.0.1-5050 and earlier ; SonicOS 7.0.1-R579 and earlier ; SonicOSv 6.5.4.4-44v-21-1452 and earlier | A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Serv | CRITICAL 9.8 | 76 % | ||
| CVE-2021-20048 | 7.0.1-R146 and earlier ; 7.0.1-5023-1349 and earlier ; 7.0.1-5018-R1715 and earlier ; … | A Stack-based buffer overflow in the SonicOS SessionID HTTP response header allows a remote authenticated attacker to cause Denial of Servic | HIGH 8.8 | 2.0 % | ||
| CVE-2021-20046 | 7.0.1-R146 and earlier ; 7.0.1-5023-1349 and earlier ; 7.0.1-5018-R1715 and earlier ; … | A Stack-based buffer overflow in the SonicOS HTTP Content-Length response header allows a remote authenticated attacker to cause Denial of S | HIGH 8.8 | 2.0 % | ||
| CVE-2021-20031 | 7.0.1-R1262 and earlier ; 7.0.1-R1283 and earlier ; 7.0.1-R579 and earlier ; … | A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary w | MEDIUM 6.1 | 13 % | ||
| CVE-2021-20019 | SonicOS - 6.5.4.7-83n ; SonicOSv - 6.5.4.4-44v-21-955 ; SonicOS - 6.5.1.12-3n ; … | A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted HTTP request, this can potentially lead | HIGH 7.5 | 1.4 % | ||
| CVE-2021-20027 | SonicOS 5.9.1.13 and earlier ; SonicOSv 6.5.4.4 and earlier ; SonicOS 6.0.5.3 and earlier ; … | A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted reques | HIGH 7.5 | 1.3 % | ||
| CVE-2020-5143 | SonicOS 6.5.4.7-79n and earlier ; SonicOS 5.9.1.7-2n and earlier ; SonicOS 5.9.1.13-5n and earlier ; … | SonicOS SSLVPN login page allows a remote unauthenticated attacker to perform firewall management administrator username enumeration based o | MEDIUM 5.3 | 1.6 % | ||
| CVE-2020-5142 | SonicOS 6.5.4.7-79n and earlier ; SonicOS 5.9.1.7-2n and earlier ; SonicOS 5.9.1.13-5n and earlier ; … | A stored cross-site scripting (XSS) vulnerability exists in the SonicOS SSLVPN web interface. A remote unauthenticated attacker is able to s | MEDIUM 6.1 | 1.2 % | ||
| CVE-2020-5141 | SonicOS 6.5.4.7-79n and earlier ; SonicOS 5.9.1.7-2n and earlier ; SonicOS 5.9.1.13-5n and earlier ; … | A vulnerability in SonicOS allows a remote unauthenticated attacker to brute force Virtual Assist ticket ID in the firewall SSLVPN service. | MEDIUM 6.5 | 1.2 % | ||
| CVE-2020-5140 | SonicOS 6.5.4.7-79n and earlier ; SonicOS 5.9.1.7-2n and earlier ; SonicOS 5.9.1.13-5n and earlier ; … | A vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service by sendi | HIGH 7.5 | 1.8 % | ||
| CVE-2020-5139 | SonicOS 6.5.4.7-79n and earlier ; SonicOS 5.9.1.7-2n and earlier ; SonicOS 5.9.1.13-5n and earlier ; … | A vulnerability in SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS) due to the release of In | HIGH 7.5 | 1.8 % | ||
| CVE-2020-5138 | SonicOS 6.5.4.7-79n and earlier ; SonicOS 5.9.1.7-2n and earlier ; SonicOS 5.9.1.13-5n and earlier ; … | A Heap Overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVP | HIGH 7.5 | 1.8 % | ||
| CVE-2020-5137 | SonicOS 6.5.4.7-79n and earlier ; SonicOS 5.9.1.7-2n and earlier ; SonicOS 5.9.1.13-5n and earlier ; … | A buffer overflow vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN | HIGH 7.5 | 1.8 % | ||
| CVE-2020-5136 | SonicOS 6.5.4.7-79n and earlier ; SonicOS 5.9.1.7-2n and earlier ; SonicOS 5.9.1.13-5n and earlier ; … | A buffer overflow vulnerability in SonicOS allows an authenticated attacker to cause Denial of Service (DoS) in the SSL-VPN and virtual assi | MEDIUM 6.5 | 1.1 % | ||
| CVE-2020-5135 | SonicOS 6.5.4.7-79n and earlier ; SonicOS 6.5.1.11-4n and earlier ; SonicOS 6.0.5.3-93o and earlier ; … | A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code | CRITICAL 9.8 | 27 % | KEV | |
| CVE-2020-5134 | SonicOS 6.5.1.11-4n and earlier ; SonicOS 6.0.5.3-93o and earlier ; SonicOSv 6.5.4.4-44v-21-794 and earlier ; … | A vulnerability in SonicOS allows an authenticated attacker to cause out-of-bound invalid file reference leads to a firewall crash. This vul | MEDIUM 6.5 | 1.1 % | ||
| CVE-2020-5133 | SonicOS 6.5.1.11-4n and earlier ; SonicOS 6.0.5.3-93o and earlier ; SonicOSv 6.5.4.4-44v-21-794 and earlier ; … | A vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service due to buffer overflow, which leads to a fire | HIGH 7.5 | 1.8 % | ||
| CVE-2020-5132 | SonicOS 6.5.4.6-79n | SonicWall SSL-VPN products and SonicWall firewall SSL-VPN feature misconfiguration leads to possible DNS flaw known as domain name collision | MEDIUM 5.3 | 1.0 % | ||
| CVE-2020-5130 | 6.5.4.4-44n and earlier | SonicOS SSLVPN LDAP login request allows remote attackers to cause external service interaction (DNS) due to improper validation of the requ | MEDIUM 5.3 | 1.3 % | ||
| CVE-2019-7479 | 5.9.1.12-4o ; 6.2.7.4-32n ; 6.5.1.4-4n ; … | A vulnerability in SonicOS allow authenticated read-only admin can elevate permissions to configuration mode. This vulnerability affected So | HIGH 7.2 | 0.9 % | ||
| CVE-2019-7487 | 6.5.3.3 and earlier | Installation of the SonicOS SSLVPN NACagent 3.5 on the Windows operating system, an autorun value is created does not put the path in quotes | HIGH 7.8 | 0.5 % | ||
| CVE-2019-7477 | 5.9.1.10 and earlier ; 6.2.7.3 ; 6.5.1.3 ; … | A vulnerability in SonicWall SonicOS and SonicOSv TLS CBC Cipher allow remote attackers to obtain sensitive plaintext data when CBC cipher s | HIGH 7.5 | 1.2 % | ||
| CVE-2019-7475 | 5.9.1.10 and earlier ; 6.2.7.3 ; 6.5.1.3 ; … | A vulnerability in SonicWall SonicOS and SonicOSv with management enabled system on specific configuration allow unprivileged user to access | CRITICAL 9.8 | 1.4 % | ||
| CVE-2019-7474 | 5.9.1.10 and earlier ; 6.2.7.3 ; 6.5.1.3 ; … | A vulnerability in SonicWall SonicOS and SonicOSv, allow authenticated read-only admin to leave the firewall in an unstable state by downloa | MEDIUM 6.5 | 0.7 % | ||
| CVE-2018-9867 | 5.9.1.10 and earlier ; 6.2.7.3 ; 6.5.1.3 ; … | In SonicWall SonicOS, administrators without full permissions can download imported certificates. Occurs when administrators who are not in | MEDIUM 5.5 | 0.2 % |