SonicWall SonicOS Improper Access Control
- Product
- SonicWall SonicOS (Gen5/Gen6/Gen7 firewalls)
- CVE
- CVE-2024-40766
- Disclosed
- 2024-08-22
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- SonicWall Gen5 and Gen6 firewalls, and Gen7 devices running SonicOS 7.0.1-5035 and older.
- Fixed
- Gen5 5.9.2.14-13o; Gen6 6.5.2.8-2n (SM9800/NSsp) or 6.5.4.15-116n; Gen7 builds after 7.0.1-5035.
Summary
An improper access control flaw in SonicOS management and SSL-VPN gave unauthorized access to firewall resources. It is not a classic RCE, but Akira and Fog ransomware affiliates used it heavily for initial access via SSL-VPN.
Root cause
Access controls in the SonicOS management interface and SSL-VPN did not correctly enforce authorization, allowing unauthorized resource access and in some conditions a firewall crash. Accounts migrated from Gen6 that kept old passwords made credential-based abuse easier.
Impact
Unauthorized access to the firewall and SSL-VPN, leading to network intrusion and ransomware deployment.
Detection
Review SSL-VPN logins for unusual sources and local accounts; version-check firmware.
Mitigation
Upgrade, restrict management to trusted sources, reset migrated local passwords and enforce MFA on SSL-VPN.