{"id":199,"created_when":"2025-01-07T16:56:25Z","created_by":"arun","updated_when":"2025-01-07T16:56:25Z","updated_by":"arun","advisory_id":"SNWLID-2025-0003","title":"SonicOS Affected By Multiple Vulnerabilities","published_when":"2025-01-07T16:56:25Z","last_updated_when":"2025-04-24T11:27:17Z","impact":"high","cvss":"8.2","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","cvss_version":3.0,"cwe":"CWE-338, CWE-287, CWE-918, CWE-269","cve":"CVE-2024-40762, CVE-2024-53704, CVE-2024-53705, CVE-2024-53706","cpe":"","summary":"

\r\n\r\n

1) CVE-2024-40762 - SonicOS SSLVPN Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG).

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generator that, in certain cases, can be predicted by an attacker potentially resulting in authentication bypass.\r\n

CVSS Score: 7.1
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
\r\nCWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\r\n\r\n

\r\n\r\n

2) CVE-2024-53704 - SonicOS SSLVPN Authentication Bypass Vulnerability

An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.\r\n

CVSS Score: 8.2
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
\r\nCWE-287: Improper Authentication\r\n\r\n

\r\n\r\n

3) CVE-2024-53705 - SonicOS SSH Management Server-Side Request Forgery Vulnerability

A Server-Side Request Forgery vulnerability in the SonicOS SSH management interface allows a remote attacker to establish a TCP connection to an IP address on any port when the user is logged in to the firewall.

CVSS Score: 6.5
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
\r\nCWE-918: Server-Side Request Forgery (SSRF)\r\n\r\n

\r\n\r\n\r\n

\r\n\r\n

4) CVE-2024-53706 - Gen7 SonicOS Cloud NSv SSH Config Function Local Privilege Escalation Vulnerability

A vulnerability in the Gen7 SonicOS Cloud platform NSv (AWS and Azure editions only), allows a remote authenticated local low-privileged attacker to elevate privileges to `root` and potentially lead to code execution.\r\n

CVSS Score: 7.8
\r\nCVSS Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
\r\nCWE-269 - Improper Privilege Management\r\n\r\n

\r\n\r\n

IMPORTANT: SonicWall SSL VPN SMA100 and SMA1000 series products are not affected by the vulnerabilities. SonicWall strongly advises users of the SonicWall Firewall products to upgrade to the mentioned fixed release version to address these vulnerabilities.

\r\n\r\nUPDATE: Proof-of-Concepts (PoCs) for the SonicOS SSLVPN Authentication Bypass Vulnerability (CVE-2024-53704) are now publicly available. This significantly increases the risk of exploitation. Customers must immediately update all unpatched firewalls (7.1.x & 8.0.0). If applying the firmware update is not possible, disable SSLVPN. For further assistance, please contact SonicWall support.\r\n","is_workaround_available":true,"workaround":"

Apply the patch as soon as possible for impacted products, latest patch builds are available for download on mysonicwall.com.

\r\n

To minimize the potential impact of SSLVPN vulnerabilities, please ensure that access is limited to trusted sources, or disable SSLVPN access from the Internet. For more information about disabling firewall SSLVPN access, see: how-can-i-setup-ssl-vpn.\r\n

To minimize the potential impact of an SSH vulnerability, we recommend restricting firewall management to trusted sources or disabling firewall SSH management from Internet access.

For more information about disabling firewall SSH management access, see: how-can-i-restrict-SonicOS-admin-access.

\r\n\r\n\r\n

If you have any further questions on restricting/disabling SSH management or require additional information, please contact SonicWall Technical Support.

","detail":"

Indicators of Compromise (IoCs)

SSLVPN Event log observed when CVE-2024-53704 - SonicOS SSLVPN Authentication Bypass Vulnerability exploited using publicly available PoC:\r\n

\r\nID: [event_ID]
\r\nEvent: SSL VPN Session
\r\nMessage Type: Simple Message String
\r\nMessage: “User [SSLVPN_User]: Reuse SSLVPN session for the no. time(s)”

","affected_products":"


Vulnerabilities

Affected Platforms and Build Versions






CVE-2024-53705


Gen6 Hardware Firewalls -SOHOW, TZ 300, TZ 300W, TZ 400, TZ 400W, TZ 500, TZ 500W, TZ 600, NSA 2650,

NSA 3600, NSA 3650, NSA 4600, NSA 4650, NSA 5600, NSA 5650, NSA 6600, NSA 6650, SM 9200, SM 9250,

SM 9400, SM 9450, SM 9600, SM 9650, TZ 300P, TZ 600P, SOHO 250, SOHO 250W, TZ 350, TZ 350W

6.5.4.15-117n and older versions.

Gen7 Firewalls - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W,

TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700

7.0.x (7.0.1-5161 and older versions).

Gen7 NSv - NSv 270, NSv 470, NSv 870

7.0.x (7.0.1-5161 and older versions).






CVE-2024-40762, CVE-2024-53704, CVE-2024-53705


Gen7 Firewalls - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W,

TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700

7.1.x (7.1.1-7058 and older versions of 7.1.x only),

and version 7.1.2-7019.

Gen7 NSv - NSv 270, NSv 470, NSv 870

7.1.x (7.1.1-7058 and older versions of 7.1.x only),

and version 7.1.2-7019.

TZ80


Version 8.0.0-8035


CVE-2024-53706


Gen7 Cloud platform NSv - NSv 270, NSv 470, NSv 870 (Only AWS and Azure editions are vulnerable)

7.1.x (7.1.1-7058 and older versions of 7.1.x only),

and version 7.1.2-7019.


","fixed_software":"


Fixed Platforms

Fixed Versions

Gen6 Hardware Firewalls -SOHOW, TZ 300, TZ 300W, TZ 400, TZ 400W, TZ 500, TZ 500W, TZ 600, NSA 2650,

NSA 3600, NSA 3650, NSA 4600, NSA 4650, NSA 5600, NSA 5650, NSA 6600, NSA 6650, SM 9200, SM 9250,

SM 9400, SM 9450, SM 9600, SM 9650, TZ 300P, TZ 600P, SOHO 250, SOHO 250W, TZ 350, TZ 350W


6.5.5.1-6n and higher

Gen7 NSv - NSv 270, NSv 470, NSv 870

Gen7 Firewalls - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W,

TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700

7.0.1-5165 and higher

7.1.3-7015 and higher

TZ80

8.0.0-8037 and higher


","credits":"Daan Keuper, Thijs Alkemade and Khaled Nassar of Computest Security through Trend Micro (Zero Day Initiative)","revision_history":"\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n","references":"","vuln_status":"Applicable","status":"published","is_published":true,"patterns":[{"name":"SonicOS Gen8 Platform - TZ/NSa","id":32,"pattern":"^8\\.0\\.0-8035$"},{"name":"SonicOS Gen7 Platform - TZ/NSa/NSsp/NSv","id":3,"pattern":"^(?:(?:7\\.0\\.0-R\\d{1,4}|7\\.0\\.1-R\\d{1,4})|(?:7\\.0\\.0-\\d+|7\\.0\\.1-(?:[0-9]|[1-9]\\d|[1-9]\\d{2}|[1-4]\\d{3}|50\\d{2}|51[0-5]\\d|5160)|7\\.0\\.1-5161)|(?:7\\.1\\.0-\\d+|7\\.1\\.1-(?:[0-9]|[1-9]\\d|[1-9]\\d{2}|[1-6]\\d{3}|70[0-4]\\d|705[0-7])|7\\.1\\.1-7058)|(?:7\\.1\\.[0-1]-\\d+|7\\.1\\.2-(?:[0-9]|[1-9]\\d|[1-9]\\d{2}|[1-6]\\d{3}|700\\d|701[0-8])|7\\.1\\.2-7019))$"},{"name":"SonicOS Gen6 Platform - TZ/NSa/SM/NSv","id":2,"pattern":"^(?:[0-5]\\.\\d+\\.\\d+\\.\\d+-\\d+n|6\\.[0-4]\\.\\d+\\.\\d+-\\d+n|6\\.5\\.[0-3]\\.\\d+-\\d+n|6\\.5\\.4\\.(?:[0-9]|1[0-4])-\\d+n|6\\.5\\.4\\.15-(?:[0-9]|[1-9]\\d|10\\d|11[0-6])n|6\\.5\\.4\\.15-117n)$"}],"vulnerable_products":[{"name":"SonicOS Gen6 Platform - TZ/NSa/SM/NSv","id":2},{"name":"SonicOS Gen7 Platform - TZ/NSa/NSsp/NSv","id":3}]}