{"id":193,"created_when":"2024-08-22T18:43:35Z","created_by":"arun","updated_when":"2024-11-20T13:18:55Z","updated_by":"domagoj","advisory_id":"SNWLID-2024-0015","title":"SonicOS Improper Access Control Vulnerability","published_when":"2024-08-22T18:43:35Z","last_updated_when":"2024-11-20T13:18:55Z","impact":"critical","cvss":"9.3","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cvss_version":3.0,"cwe":"CWE-284: Improper Access Control","cve":"CVE-2024-40766","cpe":"","summary":"

An improper access control vulnerability has been identified in the SonicWall SonicOS management access and SSLVPN, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash.

\r\nThis issue affects SonicWall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

This vulnerability is potentially being exploited in the wild. Please apply the patch as soon as possible for affected products. The latest patch builds are available for download on mysonicwall.com

","is_workaround_available":true,"workaround":"

To minimize potential impact, we recommend restricting firewall management to trusted sources or disabling firewall WAN management from Internet access. Similarly, for SSLVPN, please ensure that access is limited to trusted sources,or disable SSLVPN access from the Internet.

For more information about disabling firewall WAN management access, see: how-can-i-restrict-SonicOS-admin-access.

For more information about disabling firewall SSLVPN access, see: how-can-i-setup-ssl-vpn.

Apply the patch as soon as possible for impacted products, latest patch builds are available for download on mysonicwall.com.

\r\n\r\n\r\n

If you have any further questions on restricting/disabling WAN management or SSLVPN access or require additional information, please contact SonicWall Technical Support.

","detail":"

Recommended Actions

1. Upgrade the affected products

Please apply the patch as soon as possible for affected products. The latest patch builds are available for download on mysonicwall.com.

How can I upgrade SonicOS Firmware?

NSA 2600, Gen 5 (excluding SOHO devices) and older units which are EoL (End of Life) are susceptible to this exploit and there will not be a software update released for these out-of-support units, see: SonicWall's Product Life Cycle table.

2. Password Update for Local Users

SonicWall strongly recommends that all users of GEN5 and GEN6 firewalls with locally managed SSLVPN accounts immediately update their passwords to enhance security and prevent unauthorized access. Administrators must enable the \"User must change password\" option for each local account. Alternatively, they can use a bulk change automation script available on [SonicWall GitHub].

For GEN5 Firewalls:

Navigate to Users > Local Users. For more details, please refer to pages 1340 and 1341 of the SonicOS 5.9 Administrators Guide, titled \"Managing Users and Authentication Settings.\"

SonicOS 5.9 Administrators Guide

For GEN6 Firewalls:

Navigate to MANAGE | System Setup > Users > Local Users & Groups. For more details, please refer to pages 227 and 228 of the SonicOS 6.5 System Setup Administration Guide, titled \"Configuring Local Users Settings.\"

SonicOS 6.5 System Setup Administration Guide

3. Enabling Multi-Factor Authentication (MFA)

It is recommended to enable Multi-Factor Authentication (MFA), such as TOTP or Email-based OTP, for all SSLVPN users. This adds an extra layer of protection if credentials are compromised. Instructions for setting up MFA for SSLVPN with TOTP can be found in the configuration guide.

How do I configure 2FA for SSL VPN with TOTP?

4. SSLVPN Login Event Logging

SonicWall advises enabling event logging for all SSLVPN logins. This allows continuous monitoring of login activities, facilitating the prompt detection and response to any unauthorized access attempts.

Monitoring SSLVPN User Logins

5. Implementing Account Lockout Mechanisms

It is recommended to configure the firewall to automatically lock user accounts after a defined number of failed login attempts.

How can I configure the SonicWall firewall lockout?


Indicators of Compromise (IoCs)

The following is possible IoC:

IP addresses

88.119.175.104

45.149.172.51

172.86.116.8

216.146.25.208

194.48.154.67

162.120.71.224

45.61.157.15

PSIRT recommends if possible to enable Botnet filtering as threat actor IP addresses are automatically added to the list (How to Configure Botnet Filtering with Firewall Access Rules) if Botnet filtering cannot be enabled PSIRT strongly recommends blocking these IP addresses (How can I block an IP address using access rules?).

","affected_products":"


Impacted Platforms

Impacted Versions


SOHO (Gen 5)



5.9.2.14-12o and older versions

Gen6 Firewalls -SOHOW, TZ 300, TZ 300W, TZ 400, TZ 400W, TZ 500, TZ 500W, TZ 600, NSA 2650,

NSA 3600, NSA 3650, NSA 4600, NSA 4650, NSA 5600, NSA 5650, NSA 6600, NSA 6650, SM 9200, SM 9250,

SM 9400, SM 9450, SM 9600, SM 9650, TZ 300P, TZ 600P, SOHO 250, SOHO 250W, TZ 350, TZ 350W


6.5.4.14-109n and older versions

Gen7 Firewalls - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W,

TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700

SonicOS build version 7.0.1-5035 and older versions. 

* However SonicWall recommends you

install the latest firmware.


","fixed_software":"


Fixed Platforms

Fixed Versions


SOHO (Gen 5)



5.9.2.14-13o and higher

Gen6 Firewalls -SOHOW, TZ 300, TZ 300W, TZ 400, TZ 400W, TZ 500, TZ 500W, TZ 600, NSA 2650,

NSA 3600, NSA 3650, NSA 4600, NSA 4650, NSA 5600, NSA 5650, NSA 6600, NSA 6650, SM 9200, SM 9250,

SM 9400, SM 9450, SM 9600, SM 9650, TZ 300P, TZ 600P, SOHO 250, SOHO 250W, TZ 350, TZ 350W

6.5.2.8-2n and higher (for SM9800, NSsp 12400, NSsp 12800)

6.5.4.15.116n and higher (for other Gen6 Firewall appliances)

Gen7 Firewalls - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W,

TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700

This vulnerability is not reproducible in SonicOS firmware

version higher than 7.0.1-5035. However SonicWall recommends you

install the latest firmware.


","credits":"","revision_history":"\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\t\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n","references":"","vuln_status":"Applicable","status":"published","is_published":true,"patterns":[{"pattern":"^(?:[0-4]\\.\\d+\\.\\d+\\.\\d+-\\d+o|5\\.[0-8]\\.\\d+\\.\\d+-\\d+o|5\\.9\\.[0-1]\\.\\d+-\\d+o|5\\.9\\.2\\.(?:[0-9]|1[0-3])-\\d+o|5\\.9\\.2\\.14-(?:[0-9]|1[0-1])o|5\\.9\\.2\\.14-12o)$","name":"SonicOS Gen5 Platform - TZ/NSa","id":1},{"pattern":"^(?:[0-5]\\.\\d+\\.\\d+\\.\\d+-\\d+n|6\\.[0-4]\\.\\d+\\.\\d+-\\d+n|6\\.5\\.[0-3]\\.\\d+-\\d+n|6\\.5\\.4\\.(?:[0-9]|1[0-3])-\\d+n|6\\.5\\.4\\.14-(?:[0-9]|[1-9]\\d|10[0-8])n|6\\.5\\.4\\.14-109n)$","name":"SonicOS Gen6 Platform - TZ/NSa/SM/NSv","id":2},{"pattern":"^(?:(?:7\\.0\\.0-R\\d{1,4}|7\\.0\\.1-R\\d{1,4})|(?:7\\.0\\.0-\\d+|7\\.0\\.1-(?:[0-9]|[1-9]\\d|[1-9]\\d{2}|[1-4]\\d{3}|50[0-2]\\d|503[0-4])|7\\.0\\.1-5035))$","name":"SonicOS Gen7 Platform - TZ/NSa/NSsp/NSv","id":3}],"vulnerable_products":[{"name":"SonicOS Gen5 Platform - TZ/NSa","id":1},{"name":"SonicOS Gen6 Platform - TZ/NSa/SM/NSv","id":2},{"name":"SonicOS Gen7 Platform - TZ/NSa/NSsp/NSv","id":3}]}