SonicWall firewalls under attack. Patch now

updated Miscreants are actively abusing a high-severity authentication bypass bug in unpatched internet-facing SonicWall firewalls following the public release of proof-of-concept exploit code. The vulnerability, tracked as CVE-2024-53704, is a flaw in the SSL VPN authentication mechanism in SonicOS, the operating system that SonicWall firewalls use. If exploited, it allows remote attackers to bypass authentication on vulnerable SonicOS equipment, hijack the devices' active SSL VPN sessions, and gain unauthorized access to affected networks. "Shortly after the proof-of-concept was made public, Arctic Wolf began observing exploitation attempts of this vulnerability in the threat landscape," the threat monitoring and detection outfit warned Thursday. SonicWall first disclosed CVE-2024-53704 in early January. The security hole affects multiple Gen 7 and TZ80 SonicWall firewalls. The good news is upgrading to the latest version of SonicOS will plug the hole. Given that attackers ranging from suspected Chinese spies to ransomware criminals have a history of exploiting buggy SonicWall devices, you'd hope users patched this hole immediately. Not everyone got the memo, it appears. On January 30, Bishop Fox researchers said they were able exploit the flaw in unpatched firewalls and called the attack "trivial." SonicWall echoed this call to action in an updated security advisory, and said "customers must immediately update." If for whatever reason you can't update to a fixed firmware v...