SonicWall SonicOS auth bypass flaws threaten firewalls

Multiple vulnerabilities in SonicWall SonicOS, including authentication bypass via SSLVPN and weak token generation, affect Gen6, Gen7, and TZ80 firewalls across all sectors.

SonicWall has disclosed multiple critical vulnerabilities in SonicOS affecting Gen6, Gen7, and TZ80 firewalls that could allow remote attackers to bypass authentication. The most severe flaws include CVE-2024-53704, an improper authentication vulnerability in the SSLVPN mechanism, and CVE-2024-40762, which involves the use of a cryptographically weak pseudo-random number generator in SSLVPN authentication tokens that can be predicted by attackers. Additional vulnerabilities include a server-side request forgery flaw (CVE-2024-53705) in the SSH management interface and a privilege escalation vulnerability (CVE-2024-53706) affecting Gen7 NSv cloud platforms on AWS and Azure.

Successful exploitation could allow attackers to bypass authentication and gain unauthorized access to affected firewalls. Depending on system privileges, attackers could install programs, view, change, or delete data. The vulnerabilities affect Gen6 Hardware Firewalls prior to version 6.5.5.1-6n, Gen7 Firewalls prior to 7.1.3-7015, Gen7 NSv prior to 7.0.1-5165, and TZ80 prior to 8.0.0-8037.

MS-ISAC reports no evidence of active exploitation in the wild. Organizations are urged to apply vendor patches immediately after testing, implement network intrusion detection and prevention solutions, enforce least privilege principles, and conduct automated vulnerability scans of externally-exposed assets on a monthly or more frequent basis.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-sonicos-could-allow-a-remote-attacker-to-bypass-authentication_2025-002