SonicWall SonicOS auth bypass flaws threaten firewalls
Multiple vulnerabilities in SonicWall SonicOS, including authentication bypass via SSLVPN and weak token generation, affect Gen6, Gen7, and TZ80 firewalls across all sectors.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2024-53704 as exploited in the wild.
SonicWall has disclosed multiple critical vulnerabilities in SonicOS affecting Gen6, Gen7, and TZ80 firewalls that could allow remote attackers to bypass authentication. The most severe flaws include CVE-2024-53704, an improper authentication vulnerability in the SSLVPN mechanism, and CVE-2024-40762, which involves the use of a cryptographically weak pseudo-random number generator in SSLVPN authentication tokens that can be predicted by attackers. Additional vulnerabilities include a server-side request forgery flaw (CVE-2024-53705) in the SSH management interface and a privilege escalation vulnerability (CVE-2024-53706) affecting Gen7 NSv cloud platforms on AWS and Azure.
Successful exploitation could allow attackers to bypass authentication and gain unauthorized access to affected firewalls. Depending on system privileges, attackers could install programs, view, change, or delete data. The vulnerabilities affect Gen6 Hardware Firewalls prior to version 6.5.5.1-6n, Gen7 Firewalls prior to 7.1.3-7015, Gen7 NSv prior to 7.0.1-5165, and TZ80 prior to 8.0.0-8037.
MS-ISAC reports no evidence of active exploitation in the wild. Organizations are urged to apply vendor patches immediately after testing, implement network intrusion detection and prevention solutions, enforce least privilege principles, and conduct automated vulnerability scans of externally-exposed assets on a monthly or more frequent basis.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-sonicos-could-allow-a-remote-attacker-to-bypass-authentication_2025-002
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs