SonicWall SonicOS Improper Access Control Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Aug 23, 2024 · Catalog

   Detected

   An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

2. Sep 9, 2024 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Sep 30, 2024 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Sep 21, 2026 · Catalog

   Updated

   An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

Affected

• cpe sonicwall/sonicosversion unspecified
• vendor SonicWall SonicOSversion unspecified

Sources

• CERT-FRGovernment advisoryCVE-2024-40766

  Le 22 août 2024, Sonicwall a publié un correctif concernant la vulnérabilité critique CVE-2024-40766 affectant les pare-feux Sonicwall génération 5, 6 et 7. Cette vulnérabilité, de type contrôle d'accès défaillant, permet à un attaquant de provoquer un déni de service à distance,

  cert.ssi.gouv.fr
• CISA KEVConfirmed exploitationCVE-2024-40766

  SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.

  cisa.gov
• CVE.orgVulnerability recordCVE-2024-40766

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2024-40766

  30-day exploitation probability 18.4%

  first.org
• NIST NVDVulnerability recordCVE-2024-40766

  An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, a

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• CISA note · psirt.global.sonicwall.com
• US Government Resource · cisa.gov
• CISA note · sonicwall.com