CVE-2024-40766: SonicWall SonicOS Improper Access Control Vulnerability
First published: Fri Aug 23 2024(Updated: )
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
Credit: PSIRT@sonicwall.com PSIRT@sonicwall.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SonicWALL SonicOS | ||
| All of | ||
| SonicWALL SonicOS | <5.9.2.14-13o | |
| SonicWall SOHO | ||
| All of | ||
| SonicWALL SonicOS | <6.5.2.8-2n | |
| Any of | ||
| SonicWall NSSP 12400 | ||
| SonicWall NSSP 12800 | ||
| SonicWall SuperMassive 9800 | ||
| All of | ||
| SonicWALL SonicOS | <6.5.4.15.116n | |
| Any of | ||
| SonicWall NSA 2650 | ||
| SonicWall NSA 3600 | ||
| SonicWall NSA 3650 Firmware | ||
| SonicWall NSA 4600 | ||
| SonicWall NSA 4650 Firmware | ||
| SonicWall NSA 5600 | ||
| SonicWall NSA 5650 | ||
| SonicWall NSA 6600 | ||
| SonicWall NSA 6650 | ||
| SonicWall SM9200 | ||
| SonicWall SM 9250 | ||
| SonicWall SuperMassive 9400 | ||
| SonicWall SM 9450 | ||
| SonicWall SM 9600 | ||
| SonicWall SM 9650 | ||
| SonicWall SOHO 250W | ||
| SonicWall SOHO 250W | ||
| SonicWall SOHO | ||
| SonicWall TZ300 Firmware | ||
| SonicWall TZ300P Firmware | ||
| SonicWall TZ300W Firmware | ||
| SonicWall TZ350 Firmware | ||
| SonicWall TZ350W Firmware | ||
| SonicWall TZ400W Firmware | ||
| SonicWall TZ400W Firmware | ||
| SonicWall TZ500W | ||
| SonicWall TZ500W | ||
| SonicWall TZ600 Firmware | ||
| SonicWall TZ600P | ||
| All of | ||
| SonicWALL SonicOS | <=7.0.1-5035 | |
| Any of | ||
| SonicWall NSA 2700 | ||
| SonicWall NSA 3700 Firmware | ||
| SonicWall NSA 4700 | ||
| SonicWall NSA 5700 | ||
| SonicWall NSA 6700 Firmware | ||
| SonicWall NSSP 10700 Firmware | ||
| SonicWall NSSP 11700 | ||
| SonicWall NSSP 13700 | ||
| SonicWall TZ270 | ||
| SonicWall TZ270W Firmware | ||
| SonicWall TZ370 | ||
| SonicWall TZ370W Firmware | ||
| SonicWall TZ470 Firmware | ||
| SonicWall TZ470W Firmware | ||
| SonicWall TZ570 Firmware | ||
| SonicWall TZ570P Firmware | ||
| SonicWall TZ570W Firmware | ||
| SonicWall TZ670 Firmware |
Remedy
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-critical-access-control-flaw-in-sonicos/
- https://www.bleepingcomputer.com/news/security/sonicwall-sslvpn-access-control-flaw-is-now-exploited-in-attacks/
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015;
- https://nvd.nist.gov/vuln/detail/CVE-2024-40766
- https://www.bleepingcomputer.com/news/security/critical-sonicwall-sslvpn-bug-exploited-in-ransomware-attacks/
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015
- https://www.theregister.com/2024/10/22/akira_encrypting_again/
- https://www.bleepingcomputer.com/news/security/fog-ransomware-targets-sonicwall-vpns-to-breach-corporate-networks/
Frequently Asked Questions
What is the severity of CVE-2024-40766?
CVE-2024-40766 is classified as a critical severity vulnerability due to its potential to allow unauthorized access and cause service disruptions.
How do I fix CVE-2024-40766?
To fix CVE-2024-40766, update your SonicWall SonicOS to the latest version that addresses this vulnerability.
Which SonicWall devices are affected by CVE-2024-40766?
CVE-2024-40766 affects SonicWall Firewall Gen 5 and Gen 6 devices running vulnerable versions of SonicOS.
What type of vulnerability is CVE-2024-40766?
CVE-2024-40766 is an improper access control vulnerability that can lead to unauthorized resource access.
Can CVE-2024-40766 cause a firewall to crash?
Yes, under specific conditions, CVE-2024-40766 can lead to a crash of the firewall.
- agent/weakness
- agent/type
- agent/first-publish-date
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2024-40766
- agent/title
- agent/remedy
- agent/description
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- collector/the-register
- source/The Register
- agent/references
- agent/event
- agent/trending
- agent/source
- exploited/true
- ransomware/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- collector/nvd-cve
- vendor/sonicwall
- canonical/sonicwall sonicos
- canonical/sonicwall soho
- canonical/sonicwall nssp 12400
- canonical/sonicwall nssp 12800
- canonical/sonicwall supermassive 9800
- canonical/sonicwall nsa 2650
- canonical/sonicwall nsa 3600
- canonical/sonicwall nsa 3650 firmware
- canonical/sonicwall nsa 4600
- canonical/sonicwall nsa 4650 firmware
- canonical/sonicwall nsa 5600
- canonical/sonicwall nsa 5650
- canonical/sonicwall nsa 6600
- canonical/sonicwall nsa 6650
- canonical/sonicwall sm9200
- canonical/sonicwall sm 9250
- canonical/sonicwall supermassive 9400
- canonical/sonicwall sm 9450
- canonical/sonicwall sm 9600
- canonical/sonicwall sm 9650
- canonical/sonicwall soho 250w
- canonical/sonicwall tz300 firmware
- canonical/sonicwall tz300p firmware
- canonical/sonicwall tz300w firmware
- canonical/sonicwall tz350 firmware
- canonical/sonicwall tz350w firmware
- canonical/sonicwall tz400w firmware
- canonical/sonicwall tz500w
- canonical/sonicwall tz600 firmware
- canonical/sonicwall tz600p
- version/sonicwall sonicos/7.0.1-5035
- canonical/sonicwall nsa 2700
- canonical/sonicwall nsa 3700 firmware
- canonical/sonicwall nsa 4700
- canonical/sonicwall nsa 5700
- canonical/sonicwall nsa 6700 firmware
- canonical/sonicwall nssp 10700 firmware
- canonical/sonicwall nssp 11700
- canonical/sonicwall nssp 13700
- canonical/sonicwall tz270
- canonical/sonicwall tz270w firmware
- canonical/sonicwall tz370
- canonical/sonicwall tz370w firmware
- canonical/sonicwall tz470 firmware
- canonical/sonicwall tz470w firmware
- canonical/sonicwall tz570 firmware
- canonical/sonicwall tz570p firmware
- canonical/sonicwall tz570w firmware
- canonical/sonicwall tz670 firmware