Paper/Archive/CVE-2024-40766

CVE-2024-40766

SonicWall SonicOS — SonicWall SonicOS Improper Access Control Vulnerability

KEV · due 30 Sep ransomware use EPSS 18%public exploit SSVC act CVSS 9.3

CVSS 9.3 (ADP)9.3 / 10 × 3027.9 In CISA KEV+3030.0 EPSS percentile 97.2.972 × 2019.4 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

Affected

ProductAffectedFixed inSource

SonicOS5.9.2.14-12o and older versions–CNA

SonicOS6.5.4.14-109n and older versions–CNA

SonicOS7.0.1-5035 and older versions–CNA

Scores by source

CISA ADP9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: partial

References

advisorypsirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015 refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40766 kevcisa.gov/known-exploited-vulnerabilities-catalog