This advisory will cover the Apache Log4j suite of vulnerabilities impacting the 2.x branch, CVE-2021-44228 being the most Critical (CVSS 10.0).
| \r\n \r\n \r\n SonicWall Product (Appliance/Cloud/Virtual/OnPrem) | \r\n \r\n \r\n \r\n Status | \r\n \r\n \r\n \r\n Description | \r\n
| \r\n \r\n Email Security - Hosted Email Security (HES) - On-Premise Email Security | \r\n \r\n \r\n Impacted\r\n \r\n | \r\n \r\n Log4j 2.17.0: A new ES HotFix 10.0.13 is available for download remediating CVE-2021-44228, CVE-2021-45046 and CVE-2021-45105. Hosted Email Security (HES) has been automatically patched and no action is required by customers. Log4j 2.17.1: SonicWall performed a comprehensive analysis of Email Security resulting in no observable attack vectors for CVE-2021-44832. To remove known or potential risk from customer environments, SonicWall is working to publish an upgraded Email Security patch out of an abundance of caution to include the latest Log4j 2.17.1 version. | \r\n
| \r\n NSM - NSM SaaS - NSM On-Premise \r\n | \r\n \r\n \r\n Impacted | \r\n Log4j 2.17.0: NSM On-Prem HotFix 2.3.2-R12-H2 is available for download with log4j 2.17.0 remediating CVE-2021-44228, CVE-2021-45046 and CVE-2021-45105. Log4j 2.17.1: NSM SaaS 2.3.2-H8 has been automatically patched with log4j 2.17.1 and no action is required by customers. SonicWall performed a comprehensive analysis of NSM that resulted in no observable attack vectors for CVE-2021-44832. To remove known or potential risk from customer environments, SonicWall is working to publish an upgraded NSM (On-Prem) firmware out of an abundance of caution to include the latest Log4j 2.17.1 version. \r\n | \r\n
| \r\n WAF \r\n | \r\n \r\n \r\n Partially Impacted | \r\n WAF 3.x uses Log4j, but only when the legacy ‘Cloud Management’ feature is enabled. SonicWall recommends customers disable 'Cloud Management' if enabled. This change will not impact functionality. This feature is disabled by default. WAF 2.x and earlier versions don't use Log4j and are not impacted.. | \r\n
| \r\n \r\n Gen5 Firewalls (EOS) - TZ100/W - TZ200/W - TZ210/W - NSA 220/W - NSA 250M/250M-W - NSA 2400/MX/3500/4500/5500 - NSA E5500/6500/6500/8500/8510 | \r\n \r\n \r\n Not Impacted | \r\n \r\n \r\n Log4j2 not used in the appliance. | \r\n
| \r\n \r\n Gen6 Firewalls - TZ300/W; TZ350/W - TZ400/W - TZ500/W - TZ600 - NSA 2600/2650/3600/3650/4600 /4650/5600/5650/6600/6650 - SM 9200/9400/9600/9800 - NSa 9250/9450/9650 - NSSP 12400/12800 - NSV 10/25/50/100/200/400/800/1600 (ESX, KVM, HYPER-V, AWS, Azure) | \r\n \r\n \r\n Not Impacted | \r\n \r\n \r\n Log4j2 not used in the appliance.\r\n | \r\n
| \r\n \r\n Gen7 Firewalls - TZ270/W - TZ370/W - TZ470/W - TZ570/W - TZ670 - NSA 2700/3700/4700/5700/6700 - NSSP 10700/11700/13700/15700 - NSV 270/470/870 (ESX, KVM, HYPER-V, AWS, Azure) | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n \r\n Log4j2 not used in the appliance.\r\n | \r\n
| \r\n \r\n SonicWall Switch - SWS 12-8/12-8POE - SWS 12-10FPOE - SWS 14-24/14-24FPOE - SWS 14-48/14-48FPOE | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n \r\n Log4j2 not used in the SonicWall Switch.\r\n | \r\n
| \r\n \r\n SMA 100 - SMA 200/210/400/410 - SMA 500v (ESX, KVM, Hyper-V, AWS, Azure) \r\n | \r\n \r\n \r\n Not Impacted\r\n \r\n | \r\n \r\n \r\n Log4j2 not used in the SMA100 appliance.\r\n | \r\n
| \r\n \r\n SMA 1000 - SMA 6200/7200/6210/7210 - SMA 8200v (ESX, KVM, Hyper-V, AWS, Azure) - SRA EX 7000 \r\n | \r\n \r\n \r\n Not Impacted | \r\n \r\n \r\n Version 12.x not using vulnerable Log4j version. | \r\n
| \r\n \r\n MSW | \r\n \r\n \r\n Not Impacted | \r\n \r\n \r\n Log4j not used in the Mysonicwall service. \r\n | \r\n
| \r\n \r\n Analyzer | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n \r\n Version Analyzer 1.x is not using the vulnerable Log4j version.\r\n | \r\n
| \r\n \r\n GMS | \r\n \r\n \r\n Not Impacted | \r\n \r\n \r\n GMS version 9.x and 8.x are not using the vulnerable Log4j version.\r\n | \r\n
| \r\n \r\n Capture Client & Capture Client Portal | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n \r\n Log4j2 not used in the Capture Client.\r\n | \r\n
| \r\n \r\n CAS | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n \r\n Log4j2 not used in the CAS.\r\n | \r\n
| \r\n \r\n Access Points | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n \r\n Log4j2 not used in the SonicWall Access Points\r\n | \r\n
| \r\n \r\n WNM | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n \r\n Log4j2 not used in the WNM.\r\n | \r\n
| \r\n \r\n Capture Security Appliance | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n \r\n Log4j2 not used in the Capture Security appliance.\r\n | \r\n
| \r\n \r\n WXA - WXA 2000/4000 - Virtual: WXA 5000 - Software: WXA 500, WXA 6000 \r\n | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n \r\n WXA is not using the vulnerable Log4j version.\r\n \r\n \r\n | \r\n
| \r\n \r\n CSCMA\r\n \r\n | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n \r\n CSCMA is not using the vulnerable Log4j version.\r\n \r\n \r\n | \r\n
| \r\n \r\n EPRS\r\n \r\n | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n \r\n EPRS 1.x and 2.x are not using the vulnerable Log4j version.\r\n \r\n \r\n | \r\n
| \r\n \r\n Cloud Edge\r\n \r\n | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n \r\n Cloud Edge is not using the vulnerable Log4j version.\r\n \r\n \r\n | \r\n
| \r\n Analytics | \r\n \r\n Not Impacted | \r\n \r\n Analytics is not using the vulnerable Log4j version. | \r\n
\r\n
\r\n
Log4j 2.17.0
Email Security (ES 10.0.12 and earlier)
An ES HotFix 10.0.13 with Log4j 2.17.0 is available, remediating CVE-2021-44228, CVE-2021-45046 and CVE-2021-45105.
- Hosted Email Security (HES) automatically upgraded to 10.0.13, no action required by the HES users.
- On-premise Email Security windows and appliance users should upgrade to 10.0.13. Firmware security patch is available for download on mysonicwall.com, please carefully review the knowledge base (KB) article and follow guidance for firmware upgrade.
Log4j 2.17.1
Email Security
- SonicWall is working to publish an upgraded Email Security patch out of an abundance of caution to include the latest Log4j 2.17.1 version.
- SonicWall will reach out directly to customers with further guidance as it becomes available.
Log4j 2.17.1
NSM 2.x (OnPrem, SaaS)
WAF 3.0.x
WAF 3.x uses Log4j, but only when the legacy ‘Cloud Management’ feature is enabled. SonicWall recommends customers disable 'Cloud Management' if enabled. This change will not impact the functionality and this feature is disabled by default, for more details please see the knowledge base (KB) article. WAF 2.x and earlier versions don't use Log4j and are not impacted.
SonicWall PSIRT will continue to publish updated information as it becomes available.
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Email Security Appliances","id":18},{"name":"Hosted Email Security","id":20},{"name":"Network Security Manager","id":21}]},{"advisory_id":"SNWLID-2018-0012","title":"Apache Struts Remote Code Execution Vulnerability","published_when":"2018-08-30T15:00:00Z","last_updated_when":"2018-08-30T15:00:00Z","impact":"critical","cvss":"9.8","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-20","cve":"CVE-2018-11776","is_workaround_available":false,"summary":"Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when using results with no namespace and in same time, its upper action(s) have no or wildcard namespace. Same possibility when using url tag which doesn't have value and action set and in same time, its upper action(s) have no or wildcard namespace.","affected_products":"","vuln_status":"Applicable"},{"advisory_id":"SNWLID-2021-0022","title":"Authenticated SMA100 Arbitrary Command Injection Vulnerability","published_when":"2021-09-23T21:29:13Z","last_updated_when":"2025-04-15T15:50:44Z","impact":"high","cvss":"7.2","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-78","cve":"CVE-2021-20035","is_workaround_available":false,"summary":"Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.","affected_products":"9.0.0.10-28sv and earlier
10.2.0.7-34sv and earlier
10.2.1.0-17sv and earlier
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2021-0006","title":"Buffer Overflow in HTTP Request Header Leads to Partial Memory Leak","published_when":"2021-06-22T18:01:05Z","last_updated_when":"2021-09-01T22:17:58Z","impact":"medium","cvss":"5.3","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_version":3.0,"cwe":"CWE-200","cve":"CVE-2021-20019","is_workaround_available":false,"summary":"A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted unauthenticated HTTP request. This can potentially lead to an internal sensitive data disclosure vulnerability.
| Product | \r\nStatus | \r\n
| SonicWall Wi-Fi capable FWs\r\n (GEN6 and GEN7 TZs) | \r\nAffected | \r\n
| SonicWave APs\r\n (Series 200, 400 and 600) | \r\nAffected | \r\n
Common UNIX Printing System (CUPS) is an open-source printing system for Linux and other UNIX-like operating systems. CUPS uses the IPP (Internet Printing Protocol) to allow for printing with local and network printers. By combining these vulnerabilities (CVE-2024-47076, CVE-2024-47177, CVE-2024-47175, and CVE-2024-47176), an attacker could potentially execute remote code, which may result in the theft of sensitive information and/or cause damage to essential production systems.
The SonicWall PSIRT has analyzed CVE-2024-47076, CVE-2024-47177, CVE-2024-47175, and CVE-2024-47176 in the Common UNIX Printing System (CUPS) to assess their relevance to our products and services.
SonicWall products and cloud services do not incorporate the impacted CUPS software packages and are not affected by these vulnerabilities.
SonicWall PSIRT is aware that a proof of concept (PoC) exploit for this vulnerabilities is publicly available, we have no information regarding any exploitation of this vulnerability in the wild.
Product | Affected |
GEN6 (TZ/NSa/SM/NSv) | Not affected |
GEN7 (TZ/NSa/NSsp/NSv) | Not affected |
SMA100 (physical and virtual) | Not affected |
SMA1000 (physical and virtual) | Not affected |
MSW | Not affected |
NSM SaaS | Not affected |
NSM On-Prem | Not affected |
GMS | Not affected |
Email Security | Not affected |
Analytics | Not affected |
Switch | Not affected |
Access Points (200, 400 and 600) | Not affected |
WNM | Not affected |
Capture Security Appliance | Not affected |
Affected SMA 100 devices with 10.x firmware that requires the critical patch
This advisory will cover the CVE-2022-42889 - Text4shell Apache Commons Text RCE Vulnerability.
\r\n| \r\n \r\n \r\n SonicWall Product (Appliance/Cloud/Virtual/OnPrem) | \r\n \r\n \r\n \r\n Status | \r\n \r\n \r\n \r\n Description | \r\n
| \r\n \r\n Email Security - Hosted Email Security (HES) - On-Premise Email Security | \r\n \r\n \r\n Not Impacted\r\n \r\n | \r\n N/A \r\n | \r\n
| \r\n NSM - NSM SaaS - NSM On-Premise \r\n | \r\n \r\n TBD \r\n | \r\n Under Investigation \r\n | \r\n
| \r\n WAF \r\n | \r\n \r\n Not Impacted | \r\n N/A | \r\n
| \r\n \r\n Gen5 Firewalls (EOS) - TZ100/W - TZ200/W - TZ210/W - NSA 220/W - NSA 250M/250M-W - NSA 2400/MX/3500/4500/5500 - NSA E5500/6500/6500/8500/8510 | \r\n \r\n \r\n Not Impacted | \r\n \r\n N/A | \r\n
| \r\n \r\n Gen6 Firewalls - TZ300/W; TZ350/W - TZ400/W - TZ500/W - TZ600 - NSA 2600/2650/3600/3650/4600 /4650/5600/5650/6600/6650 - SM 9200/9400/9600/9800 - NSa 9250/9450/9650 - NSSP 12400/12800 - NSV 10/25/50/100/200/400/800/1600 (ESX, KVM, HYPER-V, AWS, Azure) | \r\n \r\n \r\n Not Impacted | \r\n \r\n N/A | \r\n
| \r\n \r\n Gen7 Firewalls - TZ270/W - TZ370/W - TZ470/W - TZ570/W - TZ670 - NSA 2700/3700/4700/5700/6700 - NSSP 10700/11700/13700/15700 - NSV 270/470/870 (ESX, KVM, HYPER-V, AWS, Azure) | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n N/A | \r\n
| \r\n \r\n SonicWall Switch - SWS 12-8/12-8POE - SWS 12-10FPOE - SWS 14-24/14-24FPOE - SWS 14-48/14-48FPOE | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n N/A | \r\n
| \r\n \r\n SMA 100 - SMA 200/210/400/410 - SMA 500v (ESX, KVM, Hyper-V, AWS, Azure) \r\n | \r\n \r\n \r\n Not Impacted\r\n \r\n | \r\n \r\n N/A | \r\n
| \r\n \r\n SMA 1000 - SMA 6200/7200/6210/7210 - SMA 8200v (ESX, KVM, Hyper-V, AWS, Azure) - SRA EX 7000 \r\n | \r\n \r\n Not Impacted | \r\n \r\n N/A \r\n | \r\n
| \r\n \r\n MSW | \r\n \r\n \r\n Not Impacted | \r\n \r\n N/A | \r\n
| \r\n \r\n Analyzer | \r\n \r\n \r\n TBD | \r\n \r\n Under Investigation | \r\n
| \r\n \r\n GMS | \r\n \r\n \r\n TBD | \r\n \r\n Under Investigation | \r\n
| \r\n \r\n Capture Client & Capture Client Portal | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n N/A | \r\n
| \r\n \r\n CAS | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n N/A | \r\n
| \r\n \r\n Access Points | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n N/A | \r\n
| \r\n \r\n WNM | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n N/A | \r\n
| \r\n \r\n Capture Security Appliance | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n N/A | \r\n
| \r\n \r\n WXA - WXA 2000/4000 - Virtual: WXA 5000 - Software: WXA 500, WXA 6000 \r\n | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n N/A \r\n \r\n | \r\n
| \r\n \r\n CSCMA\r\n \r\n | \r\n \r\n \r\n TBD | Under Investigation \r\n \r\n | \r\n
| \r\n \r\n EPRS\r\n \r\n | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n N/A \r\n \r\n | \r\n
| \r\n \r\n Cloud Edge\r\n \r\n | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n N/A \r\n \r\n | \r\n
| \r\n Analytics | \r\n \r\n TBD \r\n | \r\n \r\n Under Investigation | \r\n
\r\n
\r\n
\r\n\r\nA signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().\r\n
SonicWall is investigating its product line to determine which products and services may be affected by this vulnerability. The Affected and Fixed Products(s) can change as more information becomes available.
\r\nAs a mitigation please restrict SonicWall product(s) and services SSH access to trusted sources and/or disable SSH access from untrusted Internet sources, then apply the patch as soon as possible when available for impacted products. If you have any further questions on restricting/disabling SSH access or require additional information, please reach out to SonicWall Technical Support.","affected_products":"
The below information will change as more information becomes available.
\r\n| \r\n \r\n \r\n SonicWall Product (Appliance/Cloud/Virtual/OnPrem) | \r\n \r\n \r\n \r\n Status | \r\n \r\n
| \r\n \r\n Email Security - Hosted Email Security (HES) - On-Premise Email Security | \r\n \r\n Not affected | \r\n \r\n
| \r\n NSM - NSM On-Premise \r\n | \r\n \r\n Affected \r\n | \r\n \r\n
| \r\n \r\n Gen6 Firewalls - TZ300/W; TZ350/W - TZ400/W - TZ500/W - TZ600 - NSA 2600/2650/3600/3650/4600 /4650/5600/5650/6600/6650 - SM 9200/9400/9600/9800 - NSa 9250/9450/9650 - NSSP 12400/12800 - NSV 10/25/50/100/200/400/800/1600 (ESX, KVM, HYPER-V, AWS, Azure) | \r\n \r\n Not affected | \r\n \r\n
| \r\n \r\n Gen7 Firewalls - TZ270/W - TZ370/W - TZ470/W - TZ570/W - TZ670 - NSA 2700/3700/4700/5700/6700 - NSSP 10700/11700/13700/15700 - NSV 270/470/870 (ESX, KVM, HYPER-V, AWS, Azure) | \r\n \r\n Not affected | \r\n \r\n
| \r\n \r\n SonicWall Switch - SWS 12-8/12-8POE - SWS 12-10FPOE - SWS 14-24/14-24FPOE - SWS 14-48/14-48FPOE | \r\n \r\n \r\n \r\n Not affected | \r\n \r\n
| \r\n \r\n SMA 100 - SMA 200/210/400/410 - SMA 500v (ESX, KVM, Hyper-V, AWS, Azure) \r\n | \r\n\r\n \r\n \r\n Not affected | \r\n \r\n
| \r\n \r\n SMA 1000 - SMA 6200/7200/6210/7210 - SMA 8200v (ESX, KVM, Hyper-V, AWS, Azure) - SRA EX 7000 \r\n | \r\n \r\n Affected | \r\n \r\n
| \r\n \r\n GMS | \r\n \r\n Affected | \r\n \r\n
| \r\n Analytics | \r\n \r\n Affected | \r\n \r\n
| \r\n SonicWall Access Points | \r\n \r\n \r\n \r\n Not affected | \r\n \r\n
\r\n
\r\n
SonicWall Email Security 7.4.5 and earlier versions
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Email Security Appliances","id":18},{"name":"Hosted Email Security","id":20}]},{"advisory_id":"SNWLID-2015-0004","title":"Dell SonicWall NetExtender CVE-2015-4173 Remote Privilege Escalation Vulnerability","published_when":"2015-08-26T19:59:00Z","last_updated_when":"2018-03-12T17:29:00Z","impact":"Medium","cvss":"4.4","cvss_vector":"(AV:L/AC:M/Au:N/C:P/I:P/A:P)","cvss_version":2.0,"cwe":"","cve":"CVE-2015-4173","is_workaround_available":false,"summary":"Unquoted Windows search path vulnerability in the autorun value in Dell SonicWall NetExtender before 7.5.227 and 8.0.x before 8.0.238, as used in the SRA firmware before 7.5.1.2-40sv and 8.x before 8.0.0.3-23sv, allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% folder.","affected_products":"SonicWall NetExtender 8.0.236 or earlier
SonicWall NetExtender 7.5.226 or earlier
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"NetExtender Client","id":7}]},{"advisory_id":"SNWLID-2014-0002","title":"Dell SonicWALL NSA 2400 'stats/dashboard.jsp' Cross Site Scripting Vulnerability","published_when":"2014-03-24T16:39:00Z","last_updated_when":"2018-03-12T16:19:00Z","impact":"Medium","cvss":"4.3","cvss_vector":"(AV:N/AC:M/Au:N/C:N/I:P/A:N)","cvss_version":2.0,"cwe":"CWE-79","cve":"CVE-2014-2589","is_workaround_available":false,"summary":"Cross-site scripting (XSS) vulnerability in the Dashboard Backend service (stats/dashboard.jsp) in SonicWall Network Security Appliance (NSA) 2400 allows remote attackers to inject arbitrary web script or HTML via the sn parameter.","affected_products":"sonicwall network security appliance 2400 -
","vuln_status":"Applicable"},{"advisory_id":"SNWLID-2012-0003","title":"Dell SonicWALL Scrutinizer 'q' Parameter SQL Injection Vulnerability","published_when":"2012-07-30T22:55:00Z","last_updated_when":"2018-03-12T17:21:00Z","impact":"Medium","cvss":"6.5","cvss_vector":"(AV:N/AC:L/Au:S/C:P/I:P/A:P)","cvss_version":2.0,"cwe":"CWE-89","cve":"CVE-2012-2962","is_workaround_available":false,"summary":"SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q parameter.","affected_products":"SonicWall Scrutinizer versions up to 9.5.2 excluding 8.6.2, 9.0.0, 9.0.1, 9.5.0
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Scrutinizer","id":29}]},{"advisory_id":"SNWLID-2014-0004","title":"Dell SonicWALL Scrutinizer Multiple Security Vulnerabilities","published_when":"2014-07-16T14:19:00Z","last_updated_when":"2018-03-12T17:23:00Z","impact":"Medium","cvss":"5.5","cvss_vector":"(AV:N/AC:L/Au:S/C:N/I:P/A:P)","cvss_version":2.0,"cwe":"CWE-264","cve":"CVE-2014-4976","is_workaround_available":false,"summary":"Dell SonicWall Scrutinizer 11.0.1 allows remote authenticated users to change user passwords via the user ID in the savePrefs parameter in a change password request to cgi-bin/admin.cgi.","affected_products":"SonicWall Scrutinizer 11.0.1
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Scrutinizer","id":29}]},{"advisory_id":"SNWLID-2014-0005","title":"Dell SonicWALL Scrutinizer Multiple Security Vulnerabilities","published_when":"2014-07-16T14:19:00Z","last_updated_when":"2018-03-12T17:23:00Z","impact":"Medium","cvss":"6.5","cvss_vector":"(AV:N/AC:L/Au:S/C:P/I:P/A:P)","cvss_version":2.0,"cwe":"CWE-89","cve":"CVE-2014-4977","is_workaround_available":false,"summary":"Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the (2) user_id parameter in the changeUnit function, (3) methodDetail parameter in the methodDetail function, or (4) xcNetworkDetail parameter in the xcNetworkDetail function in d4d/exporters.php.","affected_products":"SonicWall Scrutinizer 11.0.1
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Scrutinizer","id":29}]},{"advisory_id":"SNWLID-2016-0003","title":"Dell SonicWall Secure Remote Access Multiple Command Injection Vulnerabilities","published_when":"2017-02-22T05:59:00Z","last_updated_when":"2025-10-10T16:49:33Z","impact":"critical","cvss":"9.8","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-77","cve":"CVE-2016-9682","is_workaround_available":false,"summary":"The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabilities in its web administrative interface. These vulnerabilities occur in the diagnostics CGI (/cgi-bin/diagnostics) component responsible for emailing out information about the state of the system. The application doesn't properly escape the information passed in the 'tsrDeleteRestartedFile' or 'currentTSREmailTo' variables before making a call to system(), allowing for remote command injection. Exploitation of this vulnerability yields shell access to the remote machine under the nobody user account.","affected_products":"SonicWall SRA SMB 1600
SonicWall SRA SMB 4600
SonicWall SRA SMB Virtual Appliance
SonicWall SMA 200
SonicWall SMA 400
SonicWall SMA 500v
All 7.5 versions prior to 7.5.1.0-38sv
All 8.0 versions prior to 8.0.0.1-16sv
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2016-0004","title":"Dell SonicWall Secure Remote Access Multiple Command Injection Vulnerabilities","published_when":"2017-02-22T05:59:00Z","last_updated_when":"2017-03-02T02:59:00Z","impact":"Critical","cvss":"9.8","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-77","cve":"CVE-2016-9683","is_workaround_available":false,"summary":"The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. This vulnerability occurs in the 'extensionsettings' CGI (/cgi-bin/extensionsettings) component responsible for handling some of the server's internal configurations. The CGI application doesn't properly escape the information it's passed when processing a particular multi-part form request involving scripts. The filename of the 'scriptname' variable is read in unsanitized before a call to system() is performed - allowing for remote command injection. Exploitation of this vulnerability yields shell access to the remote machine under the nobody user account. This is SonicWall Issue ID 181195.","affected_products":"SonicWall SRA SMB 1600
SonicWall SRA SMB 4600
SonicWall SRA SMB Virtual Appliance
SonicWall SMA 200
SonicWall SMA 400
SonicWall SMA 500v
All 7.5 versions prior to 7.5.1.0-38sv
All 8.0 versions prior to 8.0.0.1-16sv
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2016-0005","title":"Dell SonicWall Secure Remote Access Multiple Command Injection Vulnerabilities","published_when":"2017-02-22T05:59:00Z","last_updated_when":"2017-03-02T02:59:00Z","impact":"Critical","cvss":"9.8","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-77","cve":"CVE-2016-9684","is_workaround_available":false,"summary":"The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. This vulnerability occurs in the 'viewcert' CGI (/cgi-bin/viewcert) component responsible for processing SSL certificate information. The CGI application doesn't properly escape the information it's passed in the 'CERT' variable before a call to system() is performed - allowing for remote command injection. Exploitation of this vulnerability yields shell access to the remote machine under the nobody user account.","affected_products":"SonicWall SRA SMB 1600
SonicWall SRA SMB 4600
SonicWall SRA SMB Virtual Appliance
SonicWall SMA 200
SonicWall SMA 400
SonicWall SMA 500v
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2015-0001","title":"Dell SonicWALL Secure Remote Access Products CVE-2015-2248 Cross Site Request Forgery Vulnerability","published_when":"2015-05-01T15:59:00Z","last_updated_when":"2018-03-12T16:47:00Z","impact":"Medium","cvss":"6.8","cvss_vector":"(AV:N/AC:M/Au:N/C:P/I:P/A:P)","cvss_version":2.0,"cwe":"CWE-352","cve":"CVE-2015-2248","is_workaround_available":false,"summary":"Cross-site request forgery (CSRF) vulnerability in the user portal in Dell SonicWALL Secure Remote Access (SRA) products with firmware before 7.5.1.0-38sv and 8.x before 8.0.0.1-16sv allows remote attackers to hijack the authentication of users for requests that create bookmarks via a crafted request to cgi-bin/editBookmark.","affected_products":"SonicWall SRA SMB 1600
SonicWall SRA SMB 4600
SonicWall SRA SMB Virtual Appliance
SonicWall SMA 200
SonicWall SMA 400
SonicWall SMA 500v
All 7.5 versions prior to 7.5.1.0-38sv
All 8.0 versions prior to 8.0.0.1-16sv
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2015-0002","title":"Dell SonicWall SonicOS 'macIpSpoofView.html' Multiple Cross Site Scripting Vulnerabilities","published_when":"2015-04-29T20:59:00Z","last_updated_when":"2018-03-09T16:20:00Z","impact":"Medium","cvss":"4.3","cvss_vector":"(AV:N/AC:M/Au:N/C:N/I:P/A:N)","cvss_version":2.0,"cwe":"CWE-79","cve":"CVE-2015-3447","is_workaround_available":false,"summary":"Multiple cross-site scripting (XSS) vulnerabilities in macIpSpoofView.html in Dell SonicWall SonicOS 7.5.0.12 and 6.x allow remote attackers to inject arbitrary web script or HTML via the (1) searchSpoof or (2) searchSpoofIpDet parameter.","affected_products":"SonicWall SonicOS 5.9.1.4-3o
SonicWall SonicOS
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"SonicOS Gen5 Platform - TZ/NSa","id":1},{"name":"SonicOS Gen6 Platform - TZ/NSa/SM/NSv","id":2}]},{"advisory_id":"SNWLID-2018-0001","title":"Dell SonicWall SonicOS NSA CVE-2018-5280 HTML Injection Vulnerability","published_when":"2018-01-08T09:29:00Z","last_updated_when":"2018-01-30T16:04:00Z","impact":"Medium","cvss":"5.4","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_version":3.0,"cwe":"CWE-79","cve":"CVE-2018-5280","is_workaround_available":false,"summary":"SonicWall SonicOS on Network Security Appliance (NSA) 2016 Q4 devices has XSS via the Configure SSO screens.","affected_products":"SonicWall SonicOS 6.2.7
SonicWall SonicOS 6.2.9
SonicWall SonicOS 6.5.0
SonicWall SonicOS 6.5.1
SonicWall SonicOS 6.5.2
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"SonicOS Gen6 Platform - TZ/NSa/SM/NSv","id":2}]},{"advisory_id":"SNWLID-2018-0002","title":"Dell SonicWall SonicOS NSA CVE-2018-5281 Multiple HTML Injection Vulnerabilities","published_when":"2018-01-08T09:29:00Z","last_updated_when":"2018-01-30T16:12:00Z","impact":"Medium","cvss":"5.4","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_version":3.0,"cwe":"CWE-79","cve":"CVE-2018-5281","is_workaround_available":false,"summary":"SonicWall SonicOS on Network Security Appliance (NSA) 2017 Q4 devices has XSS via the CFS Custom Category and Cloud AV DB Exclusion Settings screens.","affected_products":"dell sonicwall sonicos -
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"SonicOS Gen5 Platform - TZ/NSa","id":1},{"name":"SonicOS Gen6 Platform - TZ/NSa/SM/NSv","id":2}]},{"advisory_id":"SNWLID-2015-0005","title":"Dell SonicWall TotalSecure TZ 100 Series CVE-2015-7770 Denial of Service Vulnerability","published_when":"2015-11-06T11:59:00Z","last_updated_when":"2016-12-07T18:25:00Z","impact":"Medium","cvss":"5.0","cvss_vector":"(AV:N/AC:L/Au:N/C:N/I:N/A:P)","cvss_version":2.0,"cwe":"CWE-20","cve":"CVE-2015-7770","is_workaround_available":false,"summary":"Dell SonicWall TotalSecure TZ 100 devices with firmware before 5.9.1.0-22o allow remote attackers to cause a denial of service via a crafted packet.","affected_products":"dell sonicwall totalsecure tz 100 firmware 5.9.1.0
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"SonicOS Gen5 Platform - TZ/NSa","id":1}]},{"advisory_id":"SNWLID-2020-0010","title":"Denial of Service (DoS) vulnerability in the SonicOS due to buffer overflow and potentially execute arbitrary code","published_when":"2020-10-12T09:04:38Z","last_updated_when":"2020-10-20T09:04:38Z","impact":"critical","cvss":"9.4","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","cvss_version":3.0,"cwe":"CWE-120","cve":"CVE-2020-5135","is_workaround_available":true,"summary":"A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnerability affected SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3 and SonicOSv 6.5.4.v.","affected_products":"SonicWall is investigating its product line and the following products may be affected:
GMS
SMA
ES
WAF
CGMS
Remaining product is still under investigation.
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4},{"name":"Secure Mobile Access (SMA) 1000 Series","id":5},{"name":"Email Security Appliances","id":18},{"name":"Global Management System (GMS)","id":19},{"name":"Hosted Email Security","id":20}]},{"advisory_id":"SNWLID-2018-0008","title":"Foreshadow- L1 Terminal Fault: SGX","published_when":"2018-08-15T16:00:00Z","last_updated_when":"2018-08-15T16:00:00Z","impact":"high","cvss":"7.9","cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cvss_version":3.0,"cwe":null,"cve":"CVE-2018-3615","is_workaround_available":false,"summary":"Systems with microprocessors utilizing speculative execution and Intel® software guard extensions (Intel® SGX) may allow unauthorized disclosure of information residing in the L1 data cache from an enclave to an attacker with local user access via a side-channel analysis.","affected_products":"SonicWall is investigating its product line and the following products may be affected:
GMS
SMA
ES
WAF
CGMS
Remaining product is still under investigation.
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4},{"name":"Secure Mobile Access (SMA) 1000 Series","id":5},{"name":"Email Security Appliances","id":18},{"name":"Global Management System (GMS)","id":19},{"name":"Hosted Email Security","id":20}]},{"advisory_id":"SNWLID-2018-0010","title":"Foreshadow- L1 Terminal Fault: VMM","published_when":"2018-08-15T17:00:00Z","last_updated_when":"2018-08-15T17:00:00Z","impact":"high","cvss":"7.1","cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cvss_version":3.0,"cwe":null,"cve":"CVE-2018-3646","is_workaround_available":false,"summary":"Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis.","affected_products":"SonicWall is investigating its product line and the following products may be affected:
GMS
SMA
ES
WAF
CGMS
Remaining product is still under investigation.
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4},{"name":"Secure Mobile Access (SMA) 1000 Series","id":5},{"name":"Email Security Appliances","id":18},{"name":"Global Management System (GMS)","id":19},{"name":"Hosted Email Security","id":20}]},{"advisory_id":"SNWLID-2019-0011","title":"Global Management System (GMS) Unauthorized User SQL Injection","published_when":"2019-12-30T20:00:00Z","last_updated_when":"2019-12-30T20:00:00Z","impact":"high","cvss":"8.1","cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-89","cve":"CVE-2019-7478","is_workaround_available":false,"summary":"A vulnerability in GMS allow unauthenticated user to SQL injection in Webservice module. This vulnerability affected GMS versions 8.4, 8.5, 8.6, 8.7, 9.0 and 9.1.","affected_products":"GMS/Analyzer 8.4
GMS/Analyzer 8.5
GMS 8.6
GMS 8.7
GMS 9.0
GMS 9.1
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Global Management System (GMS)","id":19}]},{"advisory_id":"SNWLID-2024-0007","title":"GMS ECM multiple vulnerabilities","published_when":"2024-04-30T19:20:55Z","last_updated_when":"2024-04-30T19:20:55Z","impact":"high","cvss":"7.5","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_version":3.0,"cwe":"CWE-611, CWE-259","cve":"CVE-2024-29010, CVE-2024-29011","is_workaround_available":false,"summary":"SonicWall GMS (Virtual Appliance, Windows) - 9.3.4 and earlier versions are vulnerable to the following security issues.
While it is crucial to highlight that SonicWall Analytics products remain unaffected by these vulnerabilities. Additionally, there is no substantiated evidence to suggest that these vulnerabilities are currently being actively exploited in real-world scenarios.
SonicWall strongly recommends that organizations running older versions of GMS builds upgrade to newer fixed versions.
GMS (Virtual Appliance, Windows) - 9.3.4 and earlier versions
","vuln_status":"Applicable","patterns":[{"pattern":"^(?:[0-8]\\.\\d+\\.\\d+|9\\.[0-2]\\.\\d+|9\\.3\\.[0-3]|9\\.3\\.4)$","name":"Global Management System (GMS)","id":19}],"vulnerable_products":[{"name":"Global Management System (GMS)","id":19}]},{"advisory_id":"SNWLID-2022-0021","title":"GMS File Path Manipulation","published_when":"2022-10-13T09:40:00Z","last_updated_when":"2022-10-13T09:40:00Z","impact":"medium","cvss":"5.3","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:","cvss_version":3.0,"cwe":"CWE-22","cve":"CVE-2021-20030","is_workaround_available":false,"summary":"An unauthenticated attacker can gain access to web directory containing application's binaries and configuration files through file path manipulation vulnerability.","affected_products":"SonicWall GMS versions prior 9.3.2.","vuln_status":"Applicable","patterns":[{"pattern":"^(?:[0-8]\\.\\d+\\.\\d+|9\\.[0-2]\\.\\d+|9\\.3\\.[0-1]|9\\.3\\.2)$","name":"Global Management System (GMS)","id":19}],"vulnerable_products":[{"name":"Global Management System (GMS)","id":19}]},{"advisory_id":"SNWLID-2024-0012","title":"Heap-based buffer overflow vulnerability in SonicOS IPSec VPN","published_when":"2024-07-17T16:52:33Z","last_updated_when":"2024-08-05T21:37:13Z","impact":"high","cvss":"7.5","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_version":3.0,"cwe":"CWE-122","cve":"CVE-2024-40764","is_workaround_available":true,"summary":"Impacted Platforms | Impacted Version |
Gen6 NSv - NSv10, NSv25, NSv50, NSv100, NSv200, NSv300, NSv400, NSv800, NSv1600 | 6.5.4.4-44v-21-2395 and older versions |
Gen7 - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700 NSv 270, NSv 470, NSv 870 | 7.0.1-5151 and older versions 7.1.1-7051 and older versions |
Impacted Platforms | Impacted Version |
Gen7 - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSv 270, NSv 470, NSv 870 |
|
| \r\n Product | \r\n \r\n Affected\r\n Version(s) | \r\n
| \r\n SMA100 | \r\n \r\n Under Review | \r\n
| \r\n SMA1000 | \r\n \r\n Under Review | \r\n
| \r\n SonicOS Gen6 NSv | \r\n \r\n Under Review | \r\n
| SonicOS Gen6 (TZ, NSA) | Under Review |
| \r\n SonicOS\r\n Gen7 | \r\n \r\n Under Review | \r\n
| \r\n GMS | \r\n \r\n Under\r\n Review | \r\n
| \r\n Analytics | \r\n \r\n Under\r\n Review | \r\n
| \r\n NSM (On-Prem) | \r\n \r\n Under Review | \r\n
| \r\n Capture\r\n Security Appliance | \r\n \r\n Under Review | \r\n
| \r\n Capture\r\n Client | \r\n \r\n Under Review | \r\n
| \r\n Email\r\n Security | \r\n \r\n Under Review | \r\n
| \r\n NetExtender\r\n Client | \r\n \r\n Under Review | \r\n
| \r\n Connect\r\n Tunnel Client | \r\n \r\n Under Review | \r\n
| \r\n SonicWall\r\n Switch | \r\n \r\n Under Review | \r\n
| \r\n SonicWave\r\n Access Points (621, 432o, 231c) | \r\n \r\n Under Review | \r\n
OpenSSL has released a security advisory to address multiple vulnerabilities affecting OpenSSL versions 3.0, 1.1.1, and 1.0.2.
SonicWall is investigating its product line to determine which products and cloud services may be affected by this vulnerability and the Affected and Fixed Products(s) list can change as more information becomes available.
| \r\n Product | \r\n \r\n Affected\r\n Version(s) | \r\n
| \r\n SMA100 | \r\n \r\n 10.2.1.6-37sv and earlier versions \r\n | \r\n
| \r\n SMA1000 | \r\n \r\n Platform Hotfix - 12.4.2-05352 and earlier versions | \r\n
| \r\n SonicOS Gen6 NSv | \r\n \r\n 6.5.4.4-44v-21-1551 and earlier versions | \r\n
| SonicOS Gen6 (TZ, NSA) | 6.5.4.10-95n and earlier versions |
| \r\n SonicOS\r\n Gen7 | \r\n \r\n Under Review | \r\n
| \r\n GMS | \r\n \r\n Under\r\n Review | \r\n
| \r\n Analytics | \r\n \r\n Under\r\n Review | \r\n
| \r\n NSM (On-Prem) | \r\n \r\n 2.3.3-6-R32-696 and earlier versions | \r\n
| \r\n Capture\r\n Security Appliance | \r\n \r\n 1.2.1-31 and earlier versions | \r\n
| \r\n Capture\r\n Client | \r\n \r\n Under Review | \r\n
| \r\n Email\r\n Security | \r\n \r\n Under Review | \r\n
| \r\n NetExtender\r\n Client | \r\n \r\n Under Review | \r\n
| \r\n Connect\r\n Tunnel Client | \r\n \r\n 12.4.2.0659 and earlier versions | \r\n
| \r\n SonicWall\r\n Switch | \r\n \r\n 1.2.0.0-5 and earlier versions | \r\n
| \r\n SonicWave\r\n Access Points (621, 432o, 231c) | \r\n \r\n 9.6.4.5-5o, 9.1.4.2-5o, 9.2.4.2-5o and earlier versions | \r\n
SonicWall is aware of improper neutralization of a SQL Command leading to SQL Injection vulnerability, reported by CrowdStrike, impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware or an old version of firmware 9.x (9.0.0.9-26sv or earlier).
In February 2021, SonicWall released SMA firmware 10.2.0.7 and 9.0.0.10 to fix a zero-day vulnerability, along with additional comprehensive code-strengthening. This strengthening proactively prevented this newly reported vulnerability in 9.0.0.10.
| \r\n Product | \r\n \r\n | \r\n
| \r\n SonicWall\r\n SSLVPN | \r\n \r\n Affected\r\n Version | \r\n
| \r\n SMA/SRA | \r\n \r\n 8.x,\r\n 9.0.0.9-26sv and earlier | \r\n
The below SonicWall appliances are impacted by this vulnerability.
Impacted Platforms | Impacted Version |
Gen7 - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700 NSv 270, NSv 470, NSv 870 | 7.0.1-5145 and older versions 7.1.1-7047 and older versions |
Gen6 SonicOSv - NSv (10, 25, 50, 100, 200, 300, 400, 800, 1600) on VMWare NSv (10, 25, 50, 100, 200, 300, 400, 800, 1600) on Hyper-V NSv (10, 25, 50, 100, 200, 300, 400, 800, 1600) on KVM NSv (200, 400, 800, 1600) on AWS NSv (200, 400, 800, 1600) on AWS-PAYG NSv (200, 400, 800, 1600) on Azure | 6.5.4.4-44v-21-2340 and older versions |
Gen6 Firewalls -SOHOW, TZ 300, TZ 300W, TZ 400, TZ 400W, TZ 500, TZ 500W, TZ 600, NSA 2600, NSA 2650, NSA 3600, NSA 3650, NSA 4600, NSA 4650, NSA 5600, NSA 5650, NSA 6600, NSA 6650, SM 9200, SM 9250, SM 9400, SM 9450, SM 9600, SM 9650, TZ 300P, TZ 600P, SOHO 250, SOHO 250W, TZ 350, TZ 350W | 6.5.4.13-105n and older versions |
Impacted Platforms | Impacted Versions |
Gen6 NSv - NSv10, NSv25, NSv50, NSv100, NSv200, NSv300, NSv400, NSv800, NSv1600 | 6.5.4.4-44v-21-2395 and older versions |
Gen7 - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700 NSv 270, NSv 470, NSv 870 | 7.0.1-5151 and older versions 7.1.1-7051 and older versions |
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default.
\r\nThis table will cover the Apache Log4j 1.2 vulnerability impacting the SonicWall products.
\r\n| \r\n \r\n \r\n SonicWall Product (Appliance/Cloud/Virtual/OnPrem) | \r\n \r\n \r\n \r\n Status | \r\n \r\n \r\n \r\n Description | \r\n
| \r\n \r\n \r\n Analyzer \r\n | \r\n \r\n Not Impacted | \r\n \r\n Vulnerable Component \"JMSAppender\" of log4j version 1.x is not used. | \r\n
| \r\n \r\n \r\n Analytics\r\n \r\n | \r\n \r\n Not Impacted | \r\n \r\n Vulnerable Component \"JMSAppender\" of log4j version 1.x is not used. | \r\n
| \r\n \r\n \r\n GMS \r\n | \r\n \r\n Not Impacted | \r\n \r\n Vulnerable Component \"JMSAppender\" of log4j version 1.x is not used. | \r\n
| \r\n \r\n \r\n CSCMA\r\n \r\n \r\n | \r\n \r\n Not Impacted | \r\n \r\n Vulnerable Component \"JMSAppender\" of log4j version 1.x is not used. \r\n \r\n | \r\n
| \r\n \r\n \r\n EPRS\r\n \r\n \r\n | \r\n \r\n Not Impacted | \r\n \r\n Vulnerable Component \"JMSAppender\" of log4j version 1.x is not used. \r\n \r\n | \r\n
| \r\n \r\n \r\n Cloud Edge\r\n \r\n \r\n | \r\n \r\n Not Impacted | \r\n \r\n Vulnerable Component \"JMSAppender\" of log4j version 1.x is not used. \r\n \r\n | \r\n
| \r\n \r\n \r\n NSM\r\n \r\n \r\n\r\n - NSM SaaS \r\n \r\n\r\n - NSM On-Premise\r\n \r\n | \r\n \r\n \r\n Not Impacted | \r\n \r\n \r\n Vulnerable Component \"JMSAppender\" of log4j version 1.x is not used.\r\n | \r\n
| \r\n \r\n \r\n SMA 1000\r\n \r\n \r\n\r\n - SMA 6200/7200/6210/7210\r\n \r\n\r\n - SMA 8200v (ESX, KVM, Hyper-V, AWS, Azure) - SRA EX 7000 \r\n | \r\n \r\n \r\n Not Impacted | \r\n \r\n \r\n Vulnerable Component \"JMSAppender\" of log4j version 1.x is not used.\r\n | \r\n
| \r\n \r\n \r\n WXA\r\n \r\n \r\n\r\n - WXA 2000/4000\r\n \r\n\r\n - Virtual: WXA 5000\r\n \r\n\r\n - Software: WXA 500, WXA 6000\r\n \r\n | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n \r\n Vulnerable Component \"JMSAppender\" of log4j version 1.x is not used.\r\n \r\n \r\n | \r\n
| \r\n \r\n \r\n WAF\r\n \r\n \r\n | \r\n \r\n Not Impacted | \r\n \r\n WAF 2.x and earlier versions do not use Log4j and are not impacted. \r\n WAF3.x is not using Log4j 1.x and is not impacted. \r\n | \r\n
| \r\n \r\n \r\n Email Security\r\n \r\n \r\n\r\n - Hosted Email Security (HES)\r\n \r\n\r\n - On-Premise Email Security \r\n \r\n\r\n \r\n | \r\n \r\n \r\n Not Applicable \r\n | \r\n \r\n Log4j 1.x not used in the Email Security. \r\n | \r\n
| \r\n \r\n \r\n Gen5 Firewalls (EOS)\r\n \r\n \r\n\r\n - TZ100/W\r\n \r\n\r\n - TZ200/W\r\n \r\n\r\n - TZ210/W\r\n \r\n\r\n - NSA 220/W\r\n \r\n\r\n - NSA 250M/250M-W\r\n \r\n\r\n - NSA 2400/MX/3500/4500/5500\r\n \r\n \r\n\r\n - NSA E5500/6500/6500/8500/8510\r\n \r\n\r\n \r\n | \r\n \r\n Not Applicable | \r\n \r\n \r\n Log4j not used in the Gen5 appliances. | \r\n
| \r\n \r\n \r\n Gen6 Firewalls\r\n \r\n \r\n\r\n - TZ300/W; TZ350/W\r\n \r\n\r\n - TZ400/W\r\n \r\n\r\n - TZ500/W\r\n \r\n\r\n - TZ600\r\n \r\n\r\n - NSA 2600/2650/3600/3650/4600\r\n \r\n\r\n /4650/5600/5650/6600/6650\r\n \r\n\r\n - SM 9200/9400/9600/9800\r\n \r\n\r\n - NSa 9250/9450/9650\r\n \r\n\r\n - NSSP 12400/12800\r\n \r\n\r\n - NSV 10/25/50/100/200/400/800/1600 (ESX, KVM, HYPER-V, AWS, Azure)\r\n \r\n\r\n \r\n | \r\n \r\n Not Applicable | \r\n \r\n \r\n Log4j not used in the Gen6 appliances.\r\n | \r\n
| \r\n \r\n \r\n Gen7 Firewalls\r\n \r\n \r\n\r\n - TZ270/W\r\n \r\n\r\n - TZ370/W\r\n \r\n\r\n - TZ470/W\r\n \r\n\r\n - TZ570/W\r\n \r\n\r\n - TZ670\r\n \r\n\r\n - NSA 2700/3700/4700/5700/6700\r\n \r\n\r\n - NSSP 10700/11700/13700/15700\r\n \r\n\r\n - NSV 270/470/870 (ESX, KVM, HYPER-V, AWS, Azure)\r\n \r\n\r\n \r\n | \r\n \r\n Not Applicable | \r\n \r\n \r\n Log4j not used in the Gen7 appliances.\r\n | \r\n
| \r\n \r\n \r\n SonicWall Switch\r\n \r\n \r\n\r\n - SWS 12-8/12-8POE\r\n \r\n\r\n - SWS 12-10FPOE\r\n \r\n\r\n - SWS 14-24/14-24FPOE\r\n \r\n\r\n - SWS 14-48/14-48FPOE\r\n \r\n\r\n \r\n \r\n | \r\n \r\n Not Applicable | \r\n \r\n \r\n Log4j not used in the SonicWall Switch.\r\n | \r\n
| \r\n \r\n \r\n SMA 100\r\n \r\n \r\n\r\n - SMA 200/210/400/410\r\n \r\n\r\n - SMA 500v (ESX, KVM, Hyper-V, AWS, Azure)\r\n \r\n | \r\n \r\n Not Applicable | \r\n \r\n \r\n Log4j not used in the SMA100 appliances.\r\n | \r\n
| \r\n \r\n \r\n MSW | \r\n \r\n Not Applicable | \r\n \r\n \r\n Log4j not used in the Mysonicwall service.\r\n \r\n | \r\n
| \r\n \r\n \r\n Capture Client & Capture Client Portal \r\n | \r\n \r\n Not Applicable | \r\n \r\n \r\n Log4j not used in the Capture Client.\r\n | \r\n
| \r\n \r\n \r\n CAS \r\n | \r\n \r\n Not Applicable | \r\n \r\n \r\n Log4j not used in the CAS.\r\n | \r\n
| \r\n \r\n \r\n Access Points \r\n | \r\n \r\n Not Applicable | \r\n \r\n \r\n Log4j not used in the SonicWall Access Points.\r\n | \r\n
| \r\n \r\n \r\n WNM \r\n | \r\n \r\n Not Applicable | \r\n \r\n \r\n Log4j not used in the WNM.\r\n | \r\n
| \r\n \r\n \r\n Capture Security Appliance \r\n | \r\n \r\n Not Applicable | \r\n \r\n \r\n Log4j not used in the Capture Security appliance.\r\n | \r\n
\r\n
\r\n
SonicWall Global Management System (GMS) 7.1, 7.0, 6.X, 5.X
SonicWall Analyzer 7.1, 7.0, 6.X, 5.X
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Global Management System (GMS)","id":19}]},{"advisory_id":"SNWLID-2014-0006","title":"Multiple Dell SonicWALL Products 'node_id' parameter Cross Site Scripting Vulnerability","published_when":"2014-07-24T14:55:00Z","last_updated_when":"2018-03-12T17:24:00Z","impact":"Medium","cvss":"4.3","cvss_vector":"(AV:N/AC:M/Au:N/C:N/I:P/A:N)","cvss_version":2.0,"cwe":"CWE-79","cve":"CVE-2014-5024","is_workaround_available":false,"summary":"Cross-site scripting (XSS) vulnerability in sgms/panelManager in Dell SonicWALL GMS, Analyzer, and UMA before 7.2 SP1 allows remote attackers to inject arbitrary web script or HTML via the node_id parameter.","affected_products":"SonicWall Global Management System (GMS) 7.2, 7.1, 7.0, 6.X, 5.X
SonicWall Analyzer 7.2, 7.1, 7.0, 6.X, 5.X
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Global Management System (GMS)","id":19}]},{"advisory_id":"SNWLID-2014-0007","title":"Multiple Dell SonicWALL Products CVE-2014-8420 Multiple Remote Code Execution Vulnerabilities","published_when":"2014-11-25T15:59:00Z","last_updated_when":"2018-03-12T17:25:00Z","impact":"High","cvss":"9.0","cvss_vector":"(AV:N/AC:L/Au:S/C:C/I:C/A:C)","cvss_version":2.0,"cwe":"CWE-20","cve":"CVE-2014-8420","is_workaround_available":false,"summary":"The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before 7.2 SP2, and SonicWALL UMA before 7.2 SP2 allows remote authenticated users to execute arbitrary code via unspecified vectors.","affected_products":"SonicWall Global Management System (GMS) 7.2, 7.1, 7.0, 6.X, 5.X
SonicWall Analyzer 7.2, 7.1, 7.0, 6.X, 5.X
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Global Management System (GMS)","id":19}]},{"advisory_id":"SNWLID-2015-0003","title":"Multiple Dell SonicWALL Products CVE-2015-3990 Remote Code Execution Vulnerability","published_when":"2015-05-20T18:59:00Z","last_updated_when":"2018-03-13T20:25:00Z","impact":"High","cvss":"9.0","cvss_vector":"(AV:N/AC:L/Au:S/C:C/I:C/A:C)","cvss_version":2.0,"cwe":"CWE-19","cve":"CVE-2015-3990","is_workaround_available":false,"summary":"The GMS ViewPoint (GMSVP) web application in Dell Sonicwall GMS, Analyzer, and UMA EM5000 before 7.2 SP4 allows remote authenticated users to execute arbitrary commands via vectors related to configuration.","affected_products":"SonicWall Global Management System (GMS) 7.2, 7.1, 7.0, 6.X, 5.X
SonicWall Analyzer 7.2, 7.1, 7.0, 6.X, 5.X
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Global Management System (GMS)","id":19}]},{"advisory_id":"SNWLID-2016-0001","title":"Multiple Dell SonicWALL Products Multiple Remote Code Execution Vulnerabilities","published_when":"2016-02-17T15:59:00Z","last_updated_when":"2018-03-12T17:29:00Z","impact":"Critical","cvss":"9.9","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-77","cve":"CVE-2016-2396","is_workaround_available":false,"summary":"The GMS ViewPoint (GMSVP) web application in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote authenticated users to execute arbitrary commands via vectors related to configuration input.","affected_products":"SonicWall Global Management System (GMS) 8.1, 8.0, 7.2, 7.1, 7.0, 6.X, 5.X
SonicWall Analyzer 8.1, 8.0, 7.2, 7.1, 7.0, 6.X, 5.X
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Global Management System (GMS)","id":19}]},{"advisory_id":"SNWLID-2016-0002","title":"Multiple Dell SonicWALL Products Multiple Remote Code Execution Vulnerabilities","published_when":"2016-02-17T15:59:00Z","last_updated_when":"2018-03-12T17:31:00Z","impact":"Critical","cvss":"9.8","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-77","cve":"CVE-2016-2397","is_workaround_available":false,"summary":"The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers to deserialize and execute arbitrary Java code via crafted XML data.","affected_products":"SonicWall Global Management System (GMS) 8.1, 8.0, 7.2, 7.1, 7.0, 6.X, 5.X
SonicWall Analyzer 8.1, 8.0, 7.2, 7.1, 7.0, 6.X, 5.X
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Global Management System (GMS)","id":19}]},{"advisory_id":"SNWLID-2009-0001","title":"Multiple Vendor Clientless SSL VPN Products Same Origin Policy Bypass Vulnerability","published_when":"2009-12-04T11:30:00Z","last_updated_when":"2017-08-17T01:30:00Z","impact":"Medium","cvss":"6.8","cvss_vector":"(AV:N/AC:M/Au:N/C:P/I:P/A:P)","cvss_version":2.0,"cwe":"CWE-264","cve":"CVE-2009-2631","is_workaround_available":false,"summary":"Multiple clientless SSL VPN products that run in web browsers, including Stonesoft StoneGate; Cisco ASA; SonicWALL E-Class SSL VPN and SonicWALL SSL VPN; SafeNet SecureWire Access Gateway; Juniper Networks Secure Access; Nortel CallPilot; Citrix Access Gateway; and other products, when running in configurations that do not restrict access to the same domain as the VPN, retrieve the content of remote URLs from one domain and rewrite them so they originate from the VPN's domain, which violates the same origin policy and allows remote attackers to conduct cross-site scripting attacks, read cookies that originated from other domains, access the Web VPN session to gain access to internal resources, perform key logging, and conduct other attacks. NOTE: it could be argued that this is a fundamental design problem in any clientless VPN solution, as opposed to a commonly-introduced error that can be fixed in separate implementations. Therefore a single CVE has been assigned for all products that have this design.","affected_products":"SonicWALL Aventail E-Class SRA Products
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 1000 Series","id":5}]},{"advisory_id":"SNWLID-2019-0005","title":"Multiple VPN applications insecurely store session cookies","published_when":"2019-04-12T20:17:47Z","last_updated_when":"2019-04-12T20:17:47Z","impact":"medium","cvss":"5.7","cvss_vector":"AV:L/AC:L/Au:S/C:C/I:P/A:P","cvss_version":3.0,"cwe":null,"cve":"CVE-2019-1573 CVE-2016-8201","is_workaround_available":false,"summary":"A research of Software Engineering Institute of the Carnegie Mellon University shows that multiple VPN applications store the authentication and/or session cookies insecurely in memory and/or log files.
None.
SonicWALL customers using IPSEC VPN clients (e.g. Global VPN Client) or SSL-VPN clients (e.g. Connect Tunnel, NetExtender, Mobile Connect) in their default non-debug mode are not affected.
SonicWall Firewalls are not vulnerable to the NAT Slipstreaming attack.
SonicWall Firewall does not open an alternative port set in the SIP packet header, results in an invalid connection, and packets are dropped.
","affected_products":"SonicWall Firewalls are not affected by the NAT Slipstreaming attack vulnerability.","vuln_status":"Not Applicable","patterns":[],"vulnerable_products":[{"name":"SonicOS Gen5 Platform - TZ/NSa","id":1},{"name":"SonicOS Gen6 Platform - TZ/NSa/SM/NSv","id":2},{"name":"SonicOS Gen7 Platform - TZ/NSa/NSsp/NSv","id":3}]},{"advisory_id":"SNWLID-2018-0011","title":"OpenSSH user enumeration vulnerability","published_when":"2018-08-22T16:00:00Z","last_updated_when":"2018-08-22T16:00:00Z","impact":"medium","cvss":"5.3","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_version":3.0,"cwe":"CWE-200","cve":"CVE-2018-15473","is_workaround_available":false,"summary":"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.","affected_products":"","vuln_status":"Applicable"},{"advisory_id":"SNWLID-2021-0013","title":"OpenSSL CVE-2021-3449 and CVE-2021-3450 vulnerabilities affected certain SonicWall Products","published_when":"2021-07-15T21:07:06Z","last_updated_when":"2021-10-24T21:07:06Z","impact":"high","cvss":"7.4","cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_version":3.0,"cwe":null,"cve":"CVE-2021-3449, CVE-2021-3450","is_workaround_available":false,"summary":"Certain SonicWall products (highlighted below) are affected by the OpenSSL CVE-2021-3449 and CVE-2021-3450 vulnerability.
| \r\n Product | \r\n \r\n Affected Version(s) | \r\n
| \r\n SMA100 | \r\n \r\n 10.2.0.x | \r\n
| \r\n SonicOS(Gen7) | \r\n \r\n 7.0.1 | \r\n
| \r\n Capture Client | \r\n \r\n Cc 3.5 | \r\n
| \r\n Email Security (On-Prem) | \r\n \r\n ES 10.0.9 | \r\n
| \r\n Product | \r\n \r\n Affected Version(s) | \r\n \r\n
| \r\n SMA100 | \r\n \r\n 10.2.0.x | \r\n \r\n
| \r\n SonicOS(Gen7) NSa, TZ | \r\n \r\n 7.0.1 | \r\n \r\n
| \r\n Capture Client | \r\n \r\n Cc 3.5 | \r\n \r\n
| \r\n Email Security (On-Prem) | \r\n \r\n ES 10.0.9 | \r\n
Product | Affected Version(s) |
SMA100: SMA 500v (ESX, KVM, Hyper-V, AWS, Azure) | Not Applicable |
SMA1000: SMA 6200/7200/6210/7210 SMA 8200v (ESX, KVM, Hyper-V, AWS, Azure) | Not Applicable |
SonicOS Gen6: SOHO/SOHO-W, SOHO-250 TZ300/W; TZ350/W TZ400/W TZ500/W TZ600 NSA 2600/2650/3600/3650/4600/4650/5600/5650/6600/6650 SM 9200/9400/9600/9800 NSa 9250/9450/9650 NSSP 12400/12800 NSV 10/25/50/100/200/400/800/1600 (ESX, KVM, HYPER-V, AWS, Azure) | Not Applicable |
SonicOS Gen7: TZ270/W TZ370/W TZ470/W TZ570/W TZ670 NSA 2700/3700/4700/5700/6700 NSSP 10700/11700/13700/15700 NSV 270/470/870 (ESX, KVM, HYPER-V, AWS, Azure) | Not Applicable |
GMS | prior 9.3.2 |
Analytics | prior 2.5.0.5 |
NSM | prior 2.3.3-6 |
Capture Security Appliance | Not Applicable |
Capture Client | Not Applicable |
Email Security | 10.0.17 and earlier versions are using OpenSSL 1.1.1n |
NetExtender Client | Not Applicable |
Connect Tunnel Client | Not Applicable |
SonicWall Switch SWS 12-8/12-8POE SWS 12-10FPOE SWS 14-24/14-24FPOE SWS 14-48/14-48FPOE | prior 1.2.0.0-3 |
SonicWave Access Points | Not Applicable |
Clients | Affected Version(s) |
NetExtender for Linux | Not Applicable |
NetExtender for Windows | Not Applicable |
Connect Tunnel v12.1 and earlier | Not Applicable |
Connect Tunnel v12.4 | Not Applicable |
Mobile Connect for MacOS | Not Applicable |
Mobile Connect for iOS | Not Applicable |
Mobile Connect for Android and ChromeOS | Not Applicable |
Global VPN Client (GVC) | Not Applicable |
A vulnerability CVE-2022-0778 was found in OpenSSL that allows to trigger an infinite loop by crafting a certificate that has invalid elliptic curve parameters. Since certificate parsing happens before verification of the certificate signature, any process that parses an externally supplied certificate leads to a DoS (Denial of service) attack.
SonicWall is investigating its product line to determine which products and cloud services may be affected by this vulnerability.
| \r\n Product | \r\n \r\n Affected\r\n Version(s) | \r\n
| \r\n SMA100 | \r\n \r\n 10.2.1.4-31sv and earlier versions | \r\n
| \r\n SMA1000 | \r\n \r\n 12.4.1, 12.1.0 and earlier versions | \r\n
| \r\n SonicOS Gen6 | \r\n \r\n 6.5.4.10-94 and earlier versions \r\n | \r\n
| \r\n SonicOS\r\n Gen7 | \r\n \r\n 7.0.1-5051 and earlier versions \r\n | \r\n
| \r\n GMS | \r\n \r\n prior 9.3.2 | \r\n
| \r\n Analytics | \r\n \r\n prior 2.5.0.4 | \r\n
| \r\n NSM | \r\n \r\n 2.3.3-4-R18 and earlier versions \r\n | \r\n
| \r\n Capture\r\n Security Appliance | \r\n \r\n 1.2.0-23 and earlier versions | \r\n
| \r\n Capture\r\n Client | \r\n \r\n 3.7.3 and earlier versions \r\n | \r\n
| \r\n Email\r\n Security | \r\n \r\n 10.0.16 and earlier versions \r\n | \r\n
| \r\n NetExtender\r\n Client | \r\n \r\n 10.2.835 and earlier versions (Linux only) | \r\n
| \r\n Connect\r\n Tunnel Client | \r\n \r\n prior 12.41.01041 | \r\n
| \r\n SonicWall\r\n Switch | \r\n \r\n Impacted | \r\n
| \r\n SonicWave\r\n Access Points | \r\n \r\n Impacted \r\n | \r\n
| \r\n Clients | \r\n \r\n Affected Version(s) | \r\n
| \r\n NetExtender\r\n for Linux | \r\n \r\n Linux\r\n clients prior to 10.2.839 are impacted | \r\n
| \r\n NetExtender\r\n for Windows | \r\n \r\n Not\r\n Impacted | \r\n
| \r\n Connect\r\n Tunnel v12.1 and earlier | \r\n \r\n Not\r\n Impacted | \r\n
| \r\n Connect\r\n Tunnel v12.4 | \r\n \r\n Impacted | \r\n
| \r\n Mobile\r\n Connect for MacOS | \r\n \r\n MacOS\r\n clients prior to 5.0.10 are impacted | \r\n
| \r\n Mobile\r\n Connect for iOS | \r\n \r\n iOS\r\n clients prior to 5.0.11 are impacted | \r\n
| \r\n Mobile\r\n Connect for Android and ChromeOS | \r\n \r\n Android\r\n clients prior to 5.0.18 are impacted | \r\n
| \r\n Global\r\n VPN Client (GVC) | \r\n \r\n Not\r\n Impacted | \r\n
NOTE: SonicWall PSIRT has continued to observe threat actors targeting EOL SRA devices (i.e., CVE-2021-20028), active exploitation of this vulnerability is likely in chained attacks leveraging CVE-2021-20028.
Through SonicWall PSIRT Threat Intelligence gathering, SonicWall has become aware of a ‘Post Authentication Arbitrary File Read’ vulnerability impacting end-of-life Secure Remote Access (SRA) series products, specifically appliances running all 8.x or 9.0.0.5-19sv and earlier versions. And Secure Mobile Access (SMA) 100 series products running old firmware 9.0.0.9-26sv and earlier versions.
In February 2021, SonicWall released SMA firmware 10.2.0.7 and 9.0.0.10 to fix a zero-day vulnerability, along with additional comprehensive code-strengthening. This strengthening proactively prevented this newly reported vulnerability in versions 9.0.0.10 and later.
IMPORTANT: SMA 1000 series products are not affected by this vulnerability.
| \r\n Product | \r\n \r\n | \r\n
| \r\n SonicWall\r\n SSLVPN | \r\n \r\n Affected Version | \r\n
| \r\n SRA Series | \r\n9.0.0.5-19sv and earlier versions. \r\n | \r\n
| SMA100 Series | 9.0.0.9-26sv and earlier versions. |
NOTE: SonicWall PSIRT has observed threat actors targeting EOL SRA devices (CVE-2021-20028), and active exploitation of this vulnerability is likely.
SonicWall is aware of a ‘Post Authentication OS Command Injection’ vulnerability, reported by Compass Security, impacting end-of-life Secure Remote Access (SRA) series products, specifically appliances running all 8.x or 9.0.0.5-19sv and earlier versions. And Secure Mobile Access (SMA) 100 series products running old firmware 9.0.0.9-26sv and earlier versions.
In February 2021, SonicWall released SMA firmware 10.2.0.7 and 9.0.0.10 to fix a zero-day vulnerability, along with additional comprehensive code-strengthening. This strengthening proactively prevented this newly reported vulnerability in versions 9.0.0.10 and later.
IMPORTANT: SMA 1000 series products are not affected by this vulnerability.
| \r\n Product | \r\n \r\n | \r\n
| \r\n SonicWall\r\n SSLVPN | \r\n \r\n Affected Version | \r\n
| \r\n SRA Series | \r\n9.0.0.5-19sv and earlier versions. \r\n | \r\n
| SMA100 Series | 9.0.0.9-26sv and earlier versions. |
On December 18th, 2023, researchers from the Ruhr University\r\nBochum published a protocol flaw in the SSH v2 protocol, called Terrapin\r\nAttack.
The flaw allows removing encrypted SSH messages at the begin\r\nof the communication, allowing downgrade of security aspects of SSH\r\nconnections.
This occurs because the SSH Binary Packet Protocol (BPP), mishandles the handshake phase, and mishandles\r\nuse of sequence numbers.
To carry out the Terrapin attack, a threat actor must be\r\ncapable of performing a man-in-the-middle (MITM) attack at the network layer. Another precondition\r\nis that the connection must be secured by either ChaCha20-Poly1305 or CBC with\r\nEncrypt-then-MAC.
| \r\n Product | \r\n \r\n Affected | \r\n
| \r\n GEN6 (TZ/NSa/SM/NSv) | \r\n \r\n Affected | \r\n
| \r\n GEN7 (TZ/NSa/NSsp/NSv) | \r\n \r\n Affected | \r\n
| \r\n SMA100 (physical and virtual) | \r\n \r\n Affected | \r\n
| \r\n SMA1000 (physical and virtual) | \r\n \r\n Not affected | \r\n
| \r\n MSW | \r\n \r\n Not affected | \r\n
| \r\n NSM SaaS | \r\n \r\n Not affected | \r\n
| \r\n NSM On-Prem | \r\n \r\n Affected | \r\n
| \r\n GMS | \r\n \r\n Affected | \r\n
| \r\n Email Security | \r\n \r\n Affected | \r\n
| \r\n Analytics | \r\n \r\n Affected | \r\n
| \r\n Switch | \r\n \r\n Affected | \r\n
| \r\n Access Points (200, 400 and 600) | \r\n \r\n Affected | \r\n
| \r\n WNM | \r\n \r\n Not affected | \r\n
| \r\n Capture Security Appliance | \r\n \r\n Not affected | \r\n
In early July 2024, a group of security researchers found a vulnerability in the RADIUS protocol:
CVE-2024-3596: RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by an on-path attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.
The Blast-RADIUS attack enables a man-in-the-middle attacker between the RADIUS client and server to forge a valid protocol accept message in response to a failed authentication request. This forgery could allow the attacker to access network devices and services without needing to guess or brute-force passwords or shared secrets. The attacker does not gain access to user credentials.
This vulnerability may impact any RADIUS client and server.
SonicWall PSIRT is aware that a proof of concept (PoC) exploit for this vulnerability is publicly available, we have no information regarding any exploitation of this vulnerability in the wild. No malicious use of this vulnerability has been reported to SonicWall.
","affected_products":"All SonicWall products using RADIUS authentication are affected.","vuln_status":"Applicable"},{"advisory_id":"SNWLID-2018-0005","title":"Rogue System Register Read (RSRE) – also known as Variant 3a","published_when":"2018-05-24T00:00:00Z","last_updated_when":"2018-06-04T20:00:00Z","impact":"medium","cvss":"4.3","cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","cvss_version":3.0,"cwe":"CWE-200","cve":"CVE-2018-3640","is_workaround_available":false,"summary":"Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an attacker with local user access via a side-channel analysis, aka Rogue System Register Read (RSRE), Variant 3a.","affected_products":"SonicWall is investigating its product line and the\r\nfollowing products may be affected by Meltdown/Spectre and variants:
GMS
SMA
ES
WAF
CGMS
\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
Remaining product is still under investigation.
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4},{"name":"Secure Mobile Access (SMA) 1000 Series","id":5},{"name":"Email Security Appliances","id":18},{"name":"Global Management System (GMS)","id":19},{"name":"Hosted Email Security","id":20}]},{"advisory_id":"SNWLID-2012-0002","title":"Scrutinizer Arbitrary File Upload Vulnerability","published_when":"2012-07-31T10:45:00Z","last_updated_when":"2018-03-12T17:21:00Z","impact":"High","cvss":"9.4","cvss_vector":"(AV:N/AC:L/Au:N/C:N/I:C/A:C)","cvss_version":2.0,"cwe":"","cve":"CVE-2012-2627","is_workaround_available":false,"summary":"d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote attackers to create or overwrite arbitrary files in %PROGRAMFILES%\\Scrutinizer\\snmp\\mibs\\ via a multipart/form-data POST request.","affected_products":"SonicWall Scrutinizer versions up to 9.5.0 excluding 8.6.2, 9.0.0, 9.0.1
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Scrutinizer","id":29}]},{"advisory_id":"SNWLID-2012-0005","title":"Scrutinizer Default Password Security Bypass Vulnerability","published_when":"2012-07-31T10:45:00Z","last_updated_when":"2018-03-12T17:21:00Z","impact":"High","cvss":"7.5","cvss_vector":"(AV:N/AC:L/Au:N/C:P/I:P/A:P)","cvss_version":2.0,"cwe":"CWE-89","cve":"CVE-2012-3951","is_workaround_available":false,"summary":"The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password of admin for the (1) scrutinizer and (2) scrutremote accounts, which allows remote attackers to execute arbitrary SQL commands via a TCP session.","affected_products":"SonicWall Scrutinizer versions up to 9.0.1.19899 excluding 8.6.2, 9.0.0, 9.0.1
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Scrutinizer","id":29}]},{"advisory_id":"SNWLID-2012-0001","title":"Scrutinizer HTTP Authentication Bypass Vulnerability","published_when":"2012-07-31T10:45:00Z","last_updated_when":"2018-03-08T19:03:00Z","impact":"Medium","cvss":"5.0","cvss_vector":"(AV:N/AC:L/Au:N/C:N/I:P/A:N)","cvss_version":2.0,"cwe":"CWE-287","cve":"CVE-2012-2626","is_workaround_available":false,"summary":"cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not require token authentication, which allows remote attackers to add administrative accounts via a userprefs action.","affected_products":"SonicWall Scrutinizer versions up to 9.5.0 excluding 8.6.2, 9.0.0, 9.0.1
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Scrutinizer","id":29}]},{"advisory_id":"SNWLID-2012-0004","title":"Scrutinizer Multiple Cross Site Scripting Vulnerabilities","published_when":"2012-07-31T10:45:00Z","last_updated_when":"2018-03-08T18:30:00Z","impact":"Medium","cvss":"4.3","cvss_vector":"(AV:N/AC:M/Au:N/C:N/I:P/A:N)","cvss_version":2.0,"cwe":"CWE-79","cve":"CVE-2012-3848","is_workaround_available":false,"summary":"Multiple cross-site scripting (XSS) vulnerabilities in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to d4d/exporters.php, (2) the HTTP Referer header to d4d/exporters.php, or (3) unspecified input to d4d/contextMenu.php.","affected_products":"SonicWall Scrutinizer versions up to 9.5.0 excluding 8.6.2, 9.0.0, 9.0.1
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Scrutinizer","id":29}]},{"advisory_id":"SNWLID-2021-0020","title":"Security Weakness Resulting in Potential Local Privilege Escalation When HA (High Availability) is Active","published_when":"2021-09-23T21:20:54Z","last_updated_when":"2021-09-23T21:20:54Z","impact":"medium","cvss":"4.7","cvss_vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_version":3.0,"cwe":"CWE - 250","cve":"N/A","is_workaround_available":false,"summary":"A weakness in the SMA100 Series exists when High Availability (HA) pair is active, potentially permitting an operation at a privilege's level that is higher than the minimum level required. If a malicious actor obtains a 'nobody' user shell on an impacted SMA100 device, this can potentially lead to commands being executed with root-level privilege. This is a SMA100 series security weakness, not a vulnerability that can be exploited remotely. ","affected_products":"9.0.0.10-28sv and earlier
10.2.0.7-34sv and earlier
10.2.1.0-17sv and earlier
SonicWall Capture Client version 3.7.10 and NetExtender Client Windows client 10.2.337 and earlier versions are being installed with sfpmonitor.sys driver. The client applications communicate with the driver through queries. The driver method that handles those queries has Stack-based Buffer Overflow vulnerability that allows an attacker to craft a specific query to overwrite kernel memory, causing Denial of Service (DoS) which potentially leads to code execution in the target operating system.\r\n
SonicWall strongly recommends that users of Capture Client and SSL VPN NetExtender client upgrade to the latest release version.
Capture Client 3.7.10 and earlier versions.
NetExtender Windows Client 10.2.337 (Windows 32 and 64 bit) and earlier versions.
A vulnerability in the SonicWall SMA100 appliance could potentially expose sensitive information i.e., third-party packages and library versions used in the appliance firmware to a pre-authenticated actor.
IMPORTANT: SMA 1000 series products are not affected by this vulnerability.
An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data.
IMPORTANT: There is no evidence that these vulnerabilities are being exploited in the wild.
","affected_products":"Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a remote authenticated attacker to associate another user's MFA mobile application.
There is no evidence that these vulnerabilities are being exploited in the wild. SonicWall strongly advises SMA 100 series product users, which include SMA 200, 210, 400, 410, and 500v products to upgrade to the mentioned fixed release version.
","affected_products":"| \r\n Impacted\r\n Product(s) \r\n | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.1.10-62sv and earlier versions. | \r\n
Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Command as a 'root' user which potentially leads to remote command execution vulnerability or denial of service (DoS) attack.
IMPORTANT: SMA 1000 series products are not affected by this vulnerability.
","affected_products":"SMA100 series firmware 10.2.1.4-31sv and earlier versions.\r\n
\r\nSMA100 series firmware 10.2.0.9-41sv and earlier versions.
","vuln_status":"Applicable","patterns":[{"pattern":"^(?:(?:10\\.2\\.0\\.\\d+-\\d+sv|10\\.2\\.1\\.[0-3]-\\d+sv|10\\.2\\.1\\.4-(?:[0-9]|[1-2]\\d|30)sv|10\\.2\\.1\\.4-31sv)|(?:10\\.2\\.0\\.[0-8]-\\d+sv|10\\.2\\.0\\.9-(?:[0-9]|[1-3]\\d|40)sv|10\\.2\\.0\\.9-41sv))$","name":"Secure Mobile Access (SMA) 100 Series","id":4}],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2023-0001","title":"SMA1000 Pre-Auth Improper Limitation of a Pathname to a Restricted Directory","published_when":"2023-01-19T17:47:31Z","last_updated_when":"2023-01-19T17:47:31Z","impact":"high","cvss":"7.5","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_version":3.0,"cwe":"CWE-22","cve":"CVE-2023-0126","is_workaround_available":false,"summary":"Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory.
IMPORTANT: SMA 100 series products are not affected by this vulnerability.
SMA1000 firmware 12.4.2 versions.
(12.4.1 and earlier versions are not affected by this vulnerability)
Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.
IMPORTANT: SonicWall PSIRT has been notified of possible active exploitation of the referenced vulnerability by threat actors. We strongly advises users of the SMA1000 product to upgrade to the hotfix release version to address the vulnerability.
Please note that SonicWall Firewall and SMA 100 series products are not affected by this vulnerability.
","affected_products":"Version 12.4.3-02804 (platform-hotfix) and earlier versions.","vuln_status":"Applicable","patterns":[{"pattern":"^(?:(?:[0-9]|1[0-1])\\.\\d+\\.\\d+-\\d+|12\\.[0-3]\\.\\d+-\\d+|12\\.4\\.[0-2]-\\d+|12\\.4\\.3-(?:[0-9]|[1-9]\\d|[1-9]\\d{2}|1\\d{3}|2[0-7]\\d{2}|280[0-3])|12\\.4\\.3-02804)$","name":"Central Management Server (CMS)","id":16},{"pattern":"^(?:(?:[0-9]|1[0-1])\\.\\d+\\.\\d+-\\d+|12\\.[0-3]\\.\\d+-\\d+|12\\.4\\.[0-2]-\\d+|12\\.4\\.3-(?:[0-9]|[1-9]\\d|[1-9]\\d{2}|1\\d{3}|2[0-7]\\d{2}|280[0-3])|12\\.4\\.3-02804)$","name":"Secure Mobile Access (SMA) 1000 Series","id":5}],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 1000 Series","id":5},{"name":"Central Management Server (CMS)","id":16}]},{"advisory_id":"SNWLID-2021-0029","title":"SMA1000 SNMP Null pointer exception bug in Net-SNMP vendor packet resulting in SNMP DoS","published_when":"2022-02-07T18:09:11Z","last_updated_when":"2022-02-07T18:09:11Z","impact":"medium","cvss":"4.4","cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","cvss_version":3.0,"cwe":"CWE-476","cve":"N/A","is_workaround_available":true,"summary":"A Null pointer exception bug in Net-SNMP vendor (5.9.0 and earlier) packet allows a remote authenticated attacker to cause SMA1000 SNMP Denial of Service (DoS) by an insufficient check of null pointer.","affected_products":"SonicWall SMA1000 12.4.1-02779 and earlier.","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 1000 Series","id":5}]},{"advisory_id":"SNWLID-2000-0002","title":"Soho Firewall CVE-2000-1098 Denial-Of-Service Vulnerability","published_when":"2001-01-09T05:00:00Z","last_updated_when":"2008-09-05T20:22:00Z","impact":"Medium","cvss":"5.0","cvss_vector":"(AV:N/AC:L/Au:N/C:N/I:N/A:P)","cvss_version":2.0,"cwe":"","cve":"CVE-2000-1098","is_workaround_available":false,"summary":"The web server for the SonicWALL SOHO firewall allows remote attackers to cause a denial of service via an empty GET or POST request.","affected_products":"sonicwall soho firewall 4.0.0
sonicwall soho firewall 5.0.0
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"SonicOS Gen5 Platform - TZ/NSa","id":1}]},{"advisory_id":"SNWLID-2019-0003","title":"SonicOS & SonicOSv CBC Cipher TLS Padding Vulnerability","published_when":"2019-04-01T20:00:00Z","last_updated_when":"2019-04-01T20:00:00Z","impact":"high","cvss":"7.5","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_version":3.0,"cwe":"CWE-327","cve":"CVE-2019-7477","is_workaround_available":false,"summary":"A vulnerability in SonicOS and SonicOSv TLS CBC Cipher allow remote attackers to obtain sensitive plaintext data when CBC cipher suites are enabled. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).","affected_products":"The below SonicWall appliances are impacted by this vulnerability.
| \r\n Impacted Platforms | \r\n \r\n Impacted Version | \r\n
| \r\n Gen7 - TZ270, TZ270W, TZ370,\r\n TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P,\r\n TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700,\r\n NSsp 13700, NSv 270, NSv 470, NSv 870 | \r\n \r\n
7.0.1-5119 and older versions | \r\n
| \r\n NSsp 15700 | \r\n \r\n 7.0.1-5129 and older versions | \r\n
| \r\n Gen6\r\n SonicOSv - NSv (10, 25, 50, 100, 200, 300, 400, 800, 1600) on VMWare NSv (10, 25, 50, 100, 200, 300, 400, 800, 1600) on Hyper-V NSv (10, 25, 50, 100, 200, 300, 400, 800, 1600) on KVM NSv (200, 400, 800, 1600) on AWS NSv (200, 400, 800, 1600) on AWS-PAYG NSv (200, 400, 800, 1600) on Azure | \r\n \r\n 6.5.4.4-44v-21-2079 and older\r\n versions | \r\n
| \r\n Gen6 Firewalls -SOHOW, TZ 300, TZ 300W, TZ 400, TZ 400W, TZ 500, TZ 500W, TZ 600, NSA 2600, NSA 2650, NSA 3600, NSA 3650, NSA 4600, NSA 4650, NSA 5600, NSA 5650, NSA 6600, NSA 6650, SM 9200, SM 9250, SM 9400, SM 9450, SM 9600, SM 9650, TZ 300P, TZ 600P, SOHO 250, SOHO 250W, TZ 350, TZ 350W | \r\n \r\n 6.5.4.12-101n\r\n and older versions | \r\n
\r\n\r\n
1) CVE-2024-40762 - SonicOS SSLVPN Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG).
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generator that, in certain cases, can be predicted by an attacker potentially resulting in authentication bypass.\r\n
CVSS Score: 7.1
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
\r\nCWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\r\n\r\n
\r\n\r\n
2) CVE-2024-53704 - SonicOS SSLVPN Authentication Bypass Vulnerability
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.\r\n
CVSS Score: 8.2
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
\r\nCWE-287: Improper Authentication\r\n\r\n
3) CVE-2024-53705 - SonicOS SSH Management Server-Side Request Forgery Vulnerability
A Server-Side Request Forgery vulnerability in the SonicOS SSH management interface allows a remote attacker to establish a TCP connection to an IP address on any port when the user is logged in to the firewall.
CVSS Score: 6.5
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
\r\nCWE-918: Server-Side Request Forgery (SSRF)\r\n\r\n
\r\n\r\n
4) CVE-2024-53706 - Gen7 SonicOS Cloud NSv SSH Config Function Local Privilege Escalation Vulnerability
A vulnerability in the Gen7 SonicOS Cloud platform NSv (AWS and Azure editions only), allows a remote authenticated local low-privileged attacker to elevate privileges to `root` and potentially lead to code execution.\r\n
CVSS Score: 7.8
\r\nCVSS Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
\r\nCWE-269 - Improper Privilege Management\r\n\r\n
IMPORTANT: SonicWall SSL VPN SMA100 and SMA1000 series products are not affected by the vulnerabilities. SonicWall strongly advises users of the SonicWall Firewall products to upgrade to the mentioned fixed release version to address these vulnerabilities.
\r\n\r\nUPDATE: Proof-of-Concepts (PoCs) for the SonicOS SSLVPN Authentication Bypass Vulnerability (CVE-2024-53704) are now publicly available. This significantly increases the risk of exploitation. Customers must immediately update all unpatched firewalls (7.1.x & 8.0.0). If applying the firmware update is not possible, disable SSLVPN. For further assistance, please contact SonicWall support.\r\n","affected_products":"Vulnerabilities | Affected Platforms and Build Versions |
CVE-2024-53705 | Gen6 Hardware Firewalls -SOHOW, TZ 300, TZ 300W, TZ 400, TZ 400W, TZ 500, TZ 500W, TZ 600, NSA 2650, NSA 3600, NSA 3650, NSA 4600, NSA 4650, NSA 5600, NSA 5650, NSA 6600, NSA 6650, SM 9200, SM 9250, SM 9400, SM 9450, SM 9600, SM 9650, TZ 300P, TZ 600P, SOHO 250, SOHO 250W, TZ 350, TZ 350W 6.5.4.15-117n and older versions. |
Gen7 Firewalls - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700 | |
Gen7 NSv - NSv 270, NSv 470, NSv 870 | |
CVE-2024-40762, CVE-2024-53704, CVE-2024-53705 | Gen7 Firewalls - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700 7.1.x (7.1.1-7058 and older versions of 7.1.x only), and version 7.1.2-7019. |
Gen7 NSv - NSv 270, NSv 470, NSv 870 7.1.x (7.1.1-7058 and older versions of 7.1.x only), and version 7.1.2-7019. | |
TZ80
| |
CVE-2024-53706 | Gen7 Cloud platform NSv - NSv 270, NSv 470, NSv 870 (Only AWS and Azure editions are vulnerable) 7.1.x (7.1.1-7058 and older versions of 7.1.x only), and version 7.1.2-7019. |
Affected Platforms | Affected Versions |
Gen6 Hardware Firewalls -SOHOW, TZ 300, TZ 300W, TZ 400, TZ 400W, TZ 500, TZ 500W, TZ 600, NSA 2650, NSA 3600, NSA 3650, NSA 4600, NSA 4650, NSA 5600, NSA 5650, NSA 6600, NSA 6650, SM 9200, SM 9250, SM 9400, SM 9450, SM 9600, SM 9650, TZ 300P, TZ 600P, SOHO 250, SOHO 250W, TZ 350, TZ 350W | 6.5.5.1-6n and older versions |
Gen7 NSv - NSv 270, NSv 470, NSv 870 Gen7 Firewalls - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700 Gen7 NSv - NSV270, NSv470, NSv870 (ESX, KVM, HYPER-V, AWS, Azure) | 7.0.1-5169 and older versions 7.3.1-7013 and older versions |
Gen8 Firewalls - TZ80, TZ280, TZ280W, TZ380, TZ380W, TZ480, TZ580, TZ680, NSa 2800, NSa 3800, NSa 4800, NSa 5800 | 8.1.0-8017 and older versions |
5.9.1.12-4o and earlier
6.2.7.4-32n
6.5.1.4-4n
6.5.2.3-4n
6.5.3.3-3n
6.2.7.10-3n
6.4.1.0-3n
6.5.3.3-3n
6.5.1.9-4n
SonicOSv 6.5.0.2-8v_RC363 (VMWARE)
SonicOSv 6.5.0.2.8v_RC367 (AZURE)
SonicOSv 6.5.0.2.8v_RC368 (AWS)
SonicOSv 6.5.0.2.8v_RC366 (HYPER_V)
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"SonicOS Gen5 Platform - TZ/NSa","id":1},{"name":"SonicOS Gen6 Platform - TZ/NSa/SM/NSv","id":2}]},{"advisory_id":"SNWLID-2022-0004","title":"SonicOS Content Filtering Service and SNMP feature affected by multiple vulnerabilities","published_when":"2022-04-27T09:41:53Z","last_updated_when":"2022-04-27T09:41:53Z","impact":"medium","cvss":"5.3","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_version":3.0,"cwe":"CWE-400, CWE-200, CWE-770","cve":"CVE-2022-22275, CVE-2022-22276, CVE-2022-22277, CVE-2022-22278","is_workaround_available":true,"summary":"| \r\n Product | \r\n \r\n | |
| \r\n SonicOS Gen7 | \r\n \r\n Affected Version | Affected Vulnerabilities | \r\n
| \r\n TZ Series | \r\n7.0.1-5030-R2007 and earlier versions \r\n | CVE-2022-22275 - Improper Restriction of TCP Communication Channel Potentially Resulting in DoS CVE-2022-22276 - Exposure of Sensitive Information to an Unauthorized User via SNMP CVE-2022-22277 - Exposure of Wireless Access Point Sensitive Information via SNMP CVE-2022-22278 - Allocation of Resources Without Limits or Throttling Can Potentially Result in HTTP DoS via CFS | \r\n
| NSa Series | 7.0.1-5030-R2007 and earlier versions | CVE-2022-22275 - Improper Restriction of TCP Communication Channel Potentially Resulting in DoS CVE-2022-22276 - Exposure of Sensitive Information to an Unauthorized User via SNMP CVE-2022-22277 - Exposure of Wireless Access Point Sensitive Information via SNMP CVE-2022-22278 - Allocation of Resources Without Limits or Throttling Can Potentially Result in HTTP DoS via CFS |
| NSv Series | 7.0.1.0-5030-1391 and earlier versions | CVE-2022-22275 - Improper Restriction of TCP Communication Channel Potentially Resulting in DoS CVE-2022-22276 - Exposure of Sensitive Information to an Unauthorized User via SNMP CVE-2022-22277 - Exposure of Wireless Access Point Sensitive Information via SNMP CVE-2022-22278 - Allocation of Resources Without Limits or Throttling Can Potentially Result in HTTP DoS via CFS |
| NSsp Series | 7.0.1-5030-R780 and earlier versions | CVE-2022-22275 - Improper Restriction of TCP Communication Channel Potentially Resulting in DoS CVE-2022-22276 - Exposure of Sensitive Information to an Unauthorized User via SNMP CVE-2022-22277 - Exposure of Wireless Access Point Sensitive Information via SNMP CVE-2022-22278 - Allocation of Resources Without Limits or Throttling Can Potentially Result in HTTP DoS via CFS |
| \r\n Product | \r\n \r\n | |
| \r\n SonicOS Gen6 | \r\n \r\n Affected Version | Affected Vulnerability | \r\n
| \r\n TZ Series | \r\n6.5.4.9-93n and earlier versions \r\n | CVE-2022-22277 - Exposure of Wireless Access Point Sensitive Information via SNMP | \r\n
| NSa Series | 6.5.4.9-93n and earlier versions | CVE-2022-22277 - Exposure of Wireless Access Point Sensitive Information via SNMP |
Following SonicWall products are affected by this vulnerability
| \r\n Platforms | \r\n \r\n SonicOS\r\n Running Version | \r\n
| \r\n TZ, NS a (GEN7) | \r\n \r\n 7.0.1-R146 and older | \r\n
| \r\n NS v (Virtual GEN7) | \r\n \r\n 7.0.1-5023-1349 and older | \r\n
| \r\n NS sp (GEN7) | \r\n \r\n 7.0.1-5018-R1715 and older | \r\n
| \r\n NS a, TZ, SOHO W, SuperMassive\r\n 92xx/94xx/96xx (GEN6+) | \r\n \r\n 6.5.4.8-89n and older | \r\n
| \r\n NS sp 12K, SuperMassive 9800 | \r\n \r\n 6.5.1.13-1n and older | \r\n
| \r\n SuperMassive 10K | \r\n \r\n 6.0.5.3-94o and older | \r\n
| \r\n NS v (Virtual:\r\n VMWare/Hyper-V/AWS/Azure/KVM) | \r\n \r\n 6.5.4.v_21s-1288 and older (virtual) | \r\n
| \r\n NSA, TZ, SOHO (GEN5) | \r\n \r\n EOL \r\n | \r\n
Following SonicWall products are affected by this vulnerability
| \r\n Platforms | \r\n \r\n SonicOS\r\n Running Version | \r\n
| \r\n TZ, NS a (GEN7) | \r\n \r\n 7.0.1-R1262 and older | \r\n
| \r\n NS v (Virtual GEN7) | \r\n \r\n 7.0.1-R1283 and older | \r\n
| \r\n NS sp (GEN7) | \r\n \r\n 7.0.1-R579 and older | \r\n
| \r\n NS a, TZ, SOHO W, SuperMassive\r\n 92xx/94xx/96xx (GEN6+) | \r\n \r\n 6.5.4.7 and older | \r\n
| \r\n NS sp 12K, SuperMassive 9800 | \r\n \r\n 6.5.1.12 and older | \r\n
| \r\n SuperMassive 10K | \r\n \r\n 6.0.5.3-94o and older | \r\n
| \r\n NS v (Virtual:\r\n VMWare/Hyper-V/AWS/Azure/KVM) | \r\n \r\n All versions (virtual) | \r\n
| \r\n NSA, TZ, SOHO (GEN5) | \r\n \r\n 5.9.1.13 and older | \r\n
An improper access control vulnerability has been identified in the SonicWall SonicOS management access and SSLVPN, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash.
\r\nThis issue affects SonicWall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
This vulnerability is potentially being exploited in the wild. Please apply the patch as soon as possible for affected products. The latest patch builds are available for download on mysonicwall.com
","affected_products":"Impacted Platforms | Impacted Versions |
SOHO (Gen 5) | 5.9.2.14-12o and older versions |
Gen6 Firewalls -SOHOW, TZ 300, TZ 300W, TZ 400, TZ 400W, TZ 500, TZ 500W, TZ 600, NSA 2650, NSA 3600, NSA 3650, NSA 4600, NSA 4650, NSA 5600, NSA 5650, NSA 6600, NSA 6650, SM 9200, SM 9250, SM 9400, SM 9450, SM 9600, SM 9650, TZ 300P, TZ 600P, SOHO 250, SOHO 250W, TZ 350, TZ 350W | 6.5.4.14-109n and older versions |
Gen7 Firewalls - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700 | SonicOS build version 7.0.1-5035 and older versions. * However SonicWall recommends you install the latest firmware. |
Affected Platforms | Affected Versions |
Gen6 Hardware Firewalls -SOHOW, SOHO 250, SOHO 250W, TZ 300, TZ 300P, TZ 300W, TZ 350, TZ 350W, TZ 400, TZ 400W, TZ 500, TZ 500W, TZ 600, TZ 600P, NSa 2650, NSa 3600, NSa 3650, NSa 4600, NSa 4650, NSa 5600, NSa 5650, NSa 6600, NSa 6650, SM 9200, SM 9250, SM 9400, SM 9450, SM 9600, SM 9650 | 6.5.5.2-28n and older versions |
Gen6 NSv - NSv 10, NSv 25, NSv 50, NSv 100, NSv 200, NSv 300, NSv 400, NSv 800, NSv 1600 | 6.5.4.4-44v-21-2472 and older versions |
Gen7 Hardware Firewalls - TZ 270, TZ 270W, TZ 370, TZ 370W, TZ 470, TZ 470W, TZ 570, TZ 570W, TZ 570P, TZ 670, NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700 Gen7 NSv - NSv 270, NSv 470, NSv 870 (ESX, KVM, HYPER-V, AWS, Azure) | 7.0.1-5169 and older versions 7.3.3-7015 and older versions |
Gen8 Hardware Firewalls - TZ 80, TZ 280, TZ 280W, TZ 380, TZ 380W, TZ 480, TZ 580, TZ 680, NSa 2800, NSa 3800, NSa 4800, NSa 5800 | 8.2.1-8010 and older versions |
\r\n\r\n
1) CVE-2024-12803 - SonicOS Post-authentication Stack-based buffer overflow vulnerability
A post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution.\r\n
CVSS Score: 6.0
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
\r\nCWE-121: Stack-based Buffer Overflow\r\n\r\n
\r\n\r\n
2) CVE-2024-12805 - SonicOS Post-authentication format string vulnerability
A post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution.\r\n
CVSS Score: 6.0
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
\r\nCWE-134: Use of Externally-Controlled Format String\r\n\r\n
3) CVE-2024-12806 - SonicOS Post-authentication arbitrary file read vulnerability
A post-authentication absolute path traversal vulnerability in SonicOS management allows a remote attacker to read an arbitrary file.\r\n
There is no evidence that these vulnerabilities are being exploited in the wild. SonicWall strongly advises users of the SonicWall Firewall products to upgrade to the mentioned fixed release version to address these vulnerabilities.
","affected_products":"Affected Platforms | Affected Versions |
Gen6 Hardware Firewalls -SOHOW, TZ 300, TZ 300W, TZ 400, TZ 400W, TZ 500, TZ 500W, TZ 600, NSA 2650, NSA 3600, NSA 3650, NSA 4600, NSA 4650, NSA 5600, NSA 5650, NSA 6600, NSA 6650, SM 9200, SM 9250, SM 9400, SM 9450, SM 9600, SM 9650, TZ 300P, TZ 600P, SOHO 250, SOHO 250W, TZ 350, TZ 350W | 6.5.4.15-117n and older versions |
Gen7 NSv - NSv 270, NSv 470, NSv 870 Gen7 Firewalls - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700 | 7.0.1-5161 and older version 7.1.2-7019 and older versions |
| TZ80 | Version 8.0.0-8035 |
1) CVE-2026-0399 - Multiple SonicOS post-authentication Stack-based Buffer Overflow vulnerabilities
Multiple post-authentication Stack-based Buffer Overflow vulnerabilities in SonicOS allows a remote attacker to crash a firewall.
CVSS Score: 4.9
\r\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
\r\nCWE-121: Stack-based Buffer Overflow
2) CVE-2026-0400 - SonicOS post-authentication Format String vulnerability
A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall.
CVSS Score: 4.9
\r\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-134: Use of Externally-Controlled Format String\r\n\r\n
3) CVE-2026-0401 - SonicOS post-authentication NULL Pointer Dereference vulnerability
A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall.
CVSS Score: 4.9
\r\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-476: NULL Pointer Dereference
4) CVE-2026-0402 - SonicOS post-authentication Out-of-bounds Read vulnerability
A post-authentication Out-of-bounds Read vulnerability in SonicOS allows a remote attacker to crash a firewall.
CVSS Score: 4.9
\r\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-125: Out-of-bounds Read
5) CVE-2026-3439 - SonicOS post-authentication Stack-based Buffer Overflow in certificate handling
A post-authentication Stack-based Buffer Overflow vulnerability in SonicOS certificate handling allows a remote attacker to crash a firewall.
CVSS Score: 4.9
\r\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-121: Stack-based Buffer Overflow
Affected Platform(s) | Affected Version(s) |
Gen7 hardware Firewalls - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700 Gen7 virtual Firewalls (NSv) - NSV270, NSv470, NSv870 (ESX, KVM, HYPER-V, AWS, Azure) | 7.0.1-5169 and older versions 7.3.1-7013 and older versions |
| Gen8 Firewalls - TZ80, TZ280, TZ380, TZ480, TZ580, TZ680, NSa 2800, NSa 3800, NSa 4800, NSa 5800 | 8.1.0-8017 and older versions |
Following SonicWall products are affected by this vulnerability
| \r\n Platforms | \r\n \r\n SonicOS\r\n Running Version | \r\n
| \r\n TZ, NS a (GEN7) | \r\n \r\n 7.0.1-R146 and older | \r\n
| \r\n NS v (Virtual GEN7) | \r\n \r\n 7.0.1-5023-1349 and older | \r\n
| \r\n NS sp (GEN7) | \r\n \r\n 7.0.1-5018-R1715 and older | \r\n
| \r\n NS a, TZ, SOHO W, SuperMassive\r\n 92xx/94xx/96xx (GEN6+) | \r\n \r\n 6.5.4.8-89n and older | \r\n
| \r\n NS sp 12K, SuperMassive 9800 | \r\n \r\n 6.5.1.13-1n and older | \r\n
| \r\n SuperMassive 10K | \r\n \r\n 6.0.5.3-94o and older | \r\n
| \r\n NS v (Virtual:\r\n VMWare/Hyper-V/AWS/Azure/KVM) | \r\n \r\n 6.5.4.v_21s-1288 and older (virtual) | \r\n
| \r\n NSA, TZ, SOHO (GEN5) | \r\n \r\n EOL \r\n | \r\n
The below SonicWall appliances are affected by this vulnerability.
| \r\n Products | \r\n \r\n Affected Version | \r\n
| \r\n Gen7 - TZ270, TZ270W, TZ370,\r\n TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P,\r\n TZ670, NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700,\r\n NSsp 13700, NSv 270, NSv 470, NSv 870. \r\n | \r\n \r\n SonicOS 7.1.1-7040 | \r\n
The below SonicWall appliances are impacted by this vulnerability.
| \r\n Impacted Platforms | \r\n \r\n Impacted Version | \r\n
| \r\n TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700, NSsp 11700, NSsp 13700, NSv 270, NSv 470, NSv 870 | \r\n \r\n 7.0.1-5095 and earlier versions | \r\n
| \r\n NSsp 15700 | \r\n \r\n 7.0.1-5083 and earlier versions | \r\n
| \r\n NSv 10, NSv 25, NSv 50, NSv 100, NSv 200, NSv 300, | \r\n \r\n 6.5.4.4-44v-21-1551 and earlier versions | \r\n
| SOHOW, SOHO 250, SOHO 250W, TZ300, TZ300P, TZ300W, TZ350, TZ350W, TZ400, TZ400W, TZ500, TZ500W, TZ600, TZ600P , NSA 2600, NSA3600, NSA4600, NSA5600, NSA6600, SM9200, SM9400, SM9600, SM9800, SM10200, SM10400, SM10800, NSsp12400, NSsp12800 | 6.5.4.11-97n and earlier versions |
| NSa 2650, NSa3650, NSa4650, NSa5650, NSa6650, NSa9250, NSa9450, NSa9650 | 6.5.4.11-97n and earlier versions |
Affected Platforms | Affected Versions |
Gen7 NSv - NSv 270, NSv 470, NSv 870 Gen7 Firewalls - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700 | Version 7.1.1-7040 to 7.1.3-7015 (7.1.x only) |
| TZ80 | 8.0.0-8037 and earlier versions |
The below SonicWall appliances are affected by this vulnerability.
| \r\n Products | \r\n \r\n Affected Version | \r\n
| \r\n Gen7 - TZ270, TZ270W, TZ370,\r\n TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P,\r\n TZ670, NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700,\r\n NSsp 13700, NSv 270, NSv 470, NSv 870. \r\n | \r\n \r\n SonicOS 7.0.1-5145, 7.1.1-7047 and earlier versions | \r\n
A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash.
SonicWall PSIRT is not aware of active exploitation in the wild. No reports of a PoC have been made public and malicious use of this vulnerability has not been reported to SonicWall.
And SonicWall strongly urges organizations using impacted SonicWall firewalls listed below to follow the provided guidance.
NOTE: This vulnerability ONLY impacts the SonicOS SSLVPN interface or service if enabled on the firewall.
Affected Platform(s) | Affected Version(s) |
Gen7 hardware Firewalls - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700 Gen7 virtual Firewalls (NSv) - NSV270, NSv470, NSv870 (ESX, KVM, HYPER-V, AWS, Azure) | 7.3.0-7012 and older versions (7.0.1 branch is not affected) |
| Gen8 Firewalls - TZ80, TZ280, TZ380, TZ480, TZ580, TZ680, NSa 2800, NSa 3800, NSa 4800, NSa 5800 | 8.0.2-8011 and older versions |
Note: SonicWall Gen6 firewalls, as well as the SMA 1000 and SMA 100 series SSL VPN products, are not affected by this vulnerability.
","vuln_status":"Applicable","patterns":[{"pattern":"^(?:[0-7]\\.\\d\\.\\d-\\d{1,4}|8\\.0\\.[0-1]-\\d{1,4}|8\\.0\\.2-(?:[0-9]|[1-9]\\d|[1-9]\\d{2}|[1-7]\\d{3}|800\\d|8010)|8\\.0\\.2-8011)$","name":"SonicOS Gen8 Platform - TZ/NSa","id":32},{"pattern":"^(?!7\\.0\\.1-\\d{1,4}$|7\\.0\\.0-\\d{1,4}$|<=6\\.\\d\\.\\d\\.\\d-xxxn$)(?:[0-6]\\.\\d\\.\\d-\\d{1,4}|7\\.[0-2]\\.\\d-\\d{1,4}|7\\.3\\.0-(?:[0-9]|[1-9]\\d|[1-9]\\d{2}|[1-6]\\d{3}|700\\d|701[0-1])|7\\.3\\.0-7012)$","name":"SonicOS Gen7 Platform - TZ/NSa/NSsp/NSv","id":3}],"vulnerable_products":[{"name":"SonicOS Gen7 Platform - TZ/NSa/NSsp/NSv","id":3},{"name":"SonicOS Gen8 Platform - TZ/NSa","id":32}]},{"advisory_id":"SNWLID-2020-0015","title":"SonicOS SSLVPN service unauthenticated malicious HTTP request leads to memory addresses leak","published_when":"2020-10-12T09:43:33Z","last_updated_when":"2020-10-20T09:43:33Z","impact":"high","cvss":"7.5","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_version":3.0,"cwe":"CWE-125","cve":"CVE-2020-5140","is_workaround_available":false,"summary":"A vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service by sending a malicious HTTP request that leads to memory addresses leak. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3 and SonicOSv 6.5.4.v.","affected_products":"A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash.
SonicWall PSIRT is not aware of active exploitation in the wild. No reports of a PoC have been made public and malicious use of this vulnerability has not been reported to SonicWall.
And SonicWall strongly urges organizations using impacted SonicWall firewalls listed below to follow the provided guidance.
NOTE: This vulnerability ONLY impacts the \"web management\" interface, the SonicOS SSLVPN interface is not impacted.
The below SonicWall appliances are impacted by this vulnerability.
| \r\n Impacted Platforms | \r\n \r\n Impacted Version | \r\n
| \r\n TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700, NSsp 11700, NSsp 13700, NSv 270, NSv 470, NSv 870 | \r\n \r\n 7.0.1-5095 and earlier versions | \r\n
| \r\n NSsp 15700 | \r\n \r\n 7.0.1-5083 and earlier versions | \r\n
| \r\n NSv 10, NSv 25, NSv 50, NSv 100, NSv 200, NSv 300, | \r\n \r\n 6.5.4.4-44v-21-1551 and earlier versions | \r\n
The following firewall platforms are not impacted.
\r\n
| \r\n Firewall Generations | \r\n \r\n Platforms Not Impacted | \r\n
| \r\n SonicWall Gen6 Firewalls | \r\n \r\n SOHOW, SOHO 250, SOHO 250W, TZ300, TZ300P, | \r\n
| \r\n SonicWall Gen 6.5 Firewalls | \r\n \r\n NSa 2650, NSa3650, NSa4650, NSa5650, | \r\n
Affected Platform(s) | Affected Version(s) |
Gen7 hardware Firewalls - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700 Gen7 virtual Firewalls (NSv) - NSV270, NSv470, NSv870 (ESX, KVM, HYPER-V, AWS, Azure) | 7.2.0-7015 and older versions (7.0.1 branch is not affected) |
Note: SonicWall Gen6 and Gen8 firewalls, as well as the SMA 1000 and SMA 100 series SSL VPN products, are not affected by this vulnerability.
","vuln_status":"Applicable","patterns":[{"pattern":"^(?!7\\.0\\.1-\\d{1,4}$|7\\.0\\.0-\\d{1,4}$|<=6\\.\\d\\.\\d\\.\\d-xxxn$)(?:[0-6]\\.\\d+\\.\\d+-\\d+|7\\.[0-1]\\.\\d+-\\d+|7\\.2\\.0-(?:[0-9]|[1-9]\\d|[1-9]\\d{2}|[1-6]\\d{3}|700\\d|701[0-4])|7\\.2\\.0-7015)$","name":"SonicOS Gen7 Platform - TZ/NSa/NSsp/NSv","id":3}],"vulnerable_products":[{"name":"SonicOS Gen7 Platform - TZ/NSa/NSsp/NSv","id":3}]},{"advisory_id":"SNWLID-2021-0016","title":"SonicOS vulnerability involving improper neutralization of HTTP header resulting in unauthenticated Denial of Service (DoS)","published_when":"2021-06-13T18:58:20Z","last_updated_when":"2021-06-16T18:58:20Z","impact":"medium","cvss":"5.7","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_version":3.0,"cwe":"CWE-120","cve":"CVE-2021-20027","is_workaround_available":true,"summary":"A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted request. This vulnerability affects SonicOS Gen5, Gen6, Gen7 platforms, and SonicOSv virtual firewalls.
•\tSonicWall PSIRT is not aware of any active exploitation of this vulnerability in the wild
•\tNo reports of a PoC have been made public at the time of this advisory
","affected_products":"Following SonicWall products are affected by this vulnerability
| \r\n Platforms | \r\n \r\n SonicOS\r\n Running Version | \r\n
| \r\n TZ, NS a (GEN7) | \r\n \r\n 7.0.1-R1262 and older | \r\n
| \r\n NS v (Virtual GEN7) | \r\n \r\n 7.0.1-R1219 and older | \r\n
| \r\n NS sp (GEN7) | \r\n \r\n 7.0.1-R514 and older | \r\n
| \r\n NS a, TZ, SOHO W, SuperMassive\r\n 92xx/94xx/96xx (GEN6+) | \r\n \r\n 6.5.4.7 and older | \r\n
| \r\n NS sp 12K, SuperMassive 9800 | \r\n \r\n 6.5.1.12 and older | \r\n
| \r\n SuperMassive 10K | \r\n \r\n 6.0.5.3-94o and older | \r\n
| \r\n NS v (Virtual:\r\n VMWare/Hyper-V/AWS/Azure/KVM) | \r\n \r\n All versions (virtual) | \r\n
| \r\n NSA, TZ, SOHO (GEN5) | \r\n \r\n 5.9.1.13 and older | \r\n
Vulnerabilities in IEEE 802.11 implementation were found. These vulnerabilities could allow an attacker to inject malicious frames into legitimate WiFi traffic. The discovered vulnerabilities affect all modern security protocols of WiFi, including the latest WPA3. Successful exploitation of these vulnerabilities can result in the extraction of sensitive data and the manipulation of WiFi traffic. In order for an attacker to exploit these vulnerabilities he needs to be in proximity of the WiFi network and trick a user connected to the WiFi network to visit the attacker’s server.
","affected_products":"| CVE-2020- | \r\nVulnerability\r\n Definition | \r\nSonicWall\r\n Products Potentially affected (SonicWall Wireless TZs, SonicPoint Series\r\n & SonicWave Series) | \r\n
| 24586 | \r\nNot\r\n clearing fragments from memory when (re)connecting to a network | \r\nSOHO250W,\r\n SonicWall TZs (TZ300W/TZ400W/TZ270W/TZ370W/TZ470W/TZ570W), SonicWave APs\r\n (231o/231c/224w/432o/432e/432i), SonicPoint APs (ACe/ACi/N2) | \r\n
| 24587 | \r\nReassembling\r\n fragments encrypted under different keys | \r\nSOHO250W,\r\n SonicWall TZs (TZ300W/TZ400W/TZ270W/TZ370W/TZ470W/TZ570W), SonicWave APs\r\n (231o/231c/224w/432o/432e/432i), SonicPoint APs (ACe/ACi/N2) | \r\n
| 24588 | \r\nAccepting\r\n non-SPP A-MSDU frames | \r\nSOHO250W,\r\n SonicWall TZs (TZ300W/TZ400W/TZ270W/TZ370W/TZ470W/TZ570W), SonicWave APs\r\n (231o/231c/224w/432o/432e/432i), SonicPoint APs (ACe/ACi/N2) | \r\n
| 26139 | \r\nForwarding\r\n EAPOL frames even though the sender is not yet authenticated | \r\nNot\r\n Affected | \r\n
| 26140 | \r\nAccepting\r\n plaintext data frames in a protected network | \r\nSOHO250W,\r\n SonicWall TZs (TZ300W/TZ400W/TZ270W/TZ370W/TZ470W/TZ570W), SonicWave APs\r\n (231o/231c/224w/432o/432e/432i), SonicPoint APs (ACe/ACi/N2) | \r\n
| 26141 | \r\nNot\r\n verifying the TKIP MIC of fragmented frames | \r\nNot\r\n Affected | \r\n
| 26142 | \r\nProcessing\r\n fragmented frames as full frames | \r\nNot\r\n Affected | \r\n
| 26143 | \r\nAccepting\r\n fragmented plaintext data frames in a protected network | \r\nSOHO250W,\r\n SonicWall TZs (TZ300W/TZ400W/TZ270W/TZ370W/TZ470W/TZ570W), SonicWave APs\r\n (231o/231c/224w/432o/432e/432i), SonicPoint APs (ACe/ACi/N2) | \r\n
| 26144 | \r\nAccepting\r\n plaintext A-MSDU frames that start with an RFC1042 header with EtherType\r\n EAPOL | \r\nNot\r\n Affected | \r\n
| 26145 | \r\nAccepting\r\n plaintext broadcast fragments as full frames | \r\nNot\r\n Affected | \r\n
| 26146 | \r\nReassembling\r\n encrypted fragments with non-consecutive packet numbers | \r\nSOHO250W,\r\n SonicWall TZs (TZ300W/TZ400W/TZ270W/TZ370W/TZ470W/TZ570W), SonicWave APs\r\n (231o/231c/224w/432o/432e/432i), SonicPoint APs (ACe/ACi/N2) | \r\n
| 26147 | \r\nReassembling\r\n mixed encrypted/plaintext fragments | \r\nSOHO250W,\r\n SonicWall TZs (TZ300W/TZ400W/TZ270W/TZ370W/TZ470W/TZ570W), SonicWave APs\r\n (231o/231c/224w/432o/432e/432i), SonicPoint APs (ACe/ACi/N2) | \r\n
(SonicWall SRA) Not Vulnerability
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 1000 Series","id":5}]},{"advisory_id":"SNWLID-2022-0025","title":"Sonicwall Capture Client Local Privilege Escalation via SentinelOne Agent (Aikido)","published_when":"2022-12-13T19:24:44Z","last_updated_when":"2022-12-13T19:24:44Z","impact":"high","cvss":"7.1","cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvss_version":3.0,"cwe":"CWE-59","cve":"N/A","is_workaround_available":true,"summary":"An arbitrary file deletion vulnerability (Aikido) in Sonicwall Capture Client via SentinelOne Agent could allow a local attacker to escalate privileges and delete files. The exploit was confirmed to work with 6 vulnerable EDR products, including the SentinelOne Agent for Windows.
Please note: an attacker must first obtain low-privileged access on the target system in order to exploit this vulnerability.
","affected_products":"Versions before SentinelOne Agent for Windows 22.3
","vuln_status":"Applicable","patterns":[{"pattern":"^(?:(?:(?:[0-9]|1\\d|2[0-1])\\.\\d+\\.\\d{1,3}|22\\.[0-2]\\.\\d{1,3})|(?:(?:[0-9]|1\\d|2[0-1])\\.\\d+\\.\\d{1,3}\\.\\d{1,5}|22\\.[0-2]\\.\\d{1,3}\\.\\d{1,5})|(?:(?:[0-9]|1\\d|2[0-1])\\.\\d+|22\\.[0-2]))$","name":"Capture Client","id":11}],"vulnerable_products":[{"name":"Capture Client","id":11}]},{"advisory_id":"SNWLID-2025-0007","title":"SonicWall Connect Tunnel Windows Client Improper Link Resolution Vulnerability","published_when":"2025-04-16T12:30:28Z","last_updated_when":"2025-04-16T12:30:28Z","impact":"medium","cvss":"6.1","cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","cvss_version":3.0,"cwe":"CWE-59","cve":"CVE-2025-32817","is_workaround_available":false,"summary":"A Improper Link Resolution vulnerability (CWE-59) in the SonicWall Connect Tunnel Windows (32 and 64 bit) Client, this results in unauthorized file overwrite, potentially leading to denial of service or file corruption.","affected_products":"Affected Product | Affected Version(s) |
Connect Tunnel Windows (32 and 64 bit) Client | 12.4.3.283 and earlier versions |
sonicwall sonicos 4.0
","vuln_status":"Applicable"},{"advisory_id":"SNWLID-2002-0001","title":"SonicWALL Content Filtering IP addresses can bypass URL filtering","published_when":"2002-12-31T05:00:00Z","last_updated_when":"2008-09-05T20:32:00Z","impact":"Medium","cvss":"5.0","cvss_vector":"(AV:N/AC:L/Au:N/C:P/I:N/A:N)","cvss_version":2.0,"cwe":"","cve":"CVE-2002-2181","is_workaround_available":false,"summary":"SonicWall Content Filtering allows local users to access prohibited web sites via requests to the web site's IP address instead of the domain name.","affected_products":"sonicwall content filtering *
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Content Filtering Client","id":10}]},{"advisory_id":"SNWLID-2025-0018","title":"SonicWall Email Security Affected By Multiple Vulnerabilities","published_when":"2025-11-19T11:42:50Z","last_updated_when":"2025-11-19T11:42:50Z","impact":"high","cvss":"7.2","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-494, CWE-23","cve":"CVE-2025-40604, CVE-2025-40605","is_workaround_available":false,"summary":"\r\n\r\n
1) CVE-2025-40604 - Download of Code Without Integrity Check Vulnerability
Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.\r\n
CVSS Score: 7.2
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
\r\nCWE-494: Download of Code Without Integrity Check\r\n\r\n
\r\n\r\n
2) CVE-2025-40605 - Path Traversal Vulnerability
A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injecting crafted directory-traversal sequences (such as ../) and may access files and directories outside the intended restricted path.\r\n
CVSS Score: 4.9
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
\r\nCWE-23: Relative Path Traversal\r\n\r\n
\r\n\r\n
\r\n\r\nSonicWall strongly advises users of the Email Security products (ES Appliance 5000, 5050, 7000, 7050, 9000, VMWare and Hyper-V) to upgrade to the mentioned fixed release version to address these vulnerabilities.
There is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild.
| \r\n Affected\r\n Product(s) \r\n | \r\n \r\n Affected\r\n Versions | \r\n
| \r\n Email Security | \r\n \r\n 10.0.33.8195 and earlier versions. | \r\n
1) CVE-2026-3468 - Stored Cross-Site Scripting (XSS) Vulnerability
A stored Cross-Site Scripting (XSS) vulnerability has been identified in the SonicWall Email Security appliance due to improper neutralization of user-supplied input during web page generation, allowing a remote authenticated attacker as admin user to potentially execute arbitrary JavaScript code.\r\n
CVSS Score: 3.5
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
\r\nCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\r\n\r\n
\r\n\r\n
2) CVE-2026-3469 - Denial of Service (DoS) via Malformed Input
A denial-of-service (DoS) vulnerability exists due to improper input validation in the SonicWall Email Security appliance, allowing a remote authenticated attacker as admin user to cause the application to become unresponsive.\r\n
CVSS Score: 2.7
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
\r\nCWE-20 – Improper Input Validation\r\n
\r\n\r\n
3) CVE-2026-3470 - Lack of Proper Input Sanitization leading to data corruption
A vulnerability exists in the SonicWall Email Security appliance due to improper input sanitization that may lead to data corruption, allowing a remote authenticated attacker as admin user could exploit this issue by providing crafted input that corrupts application database.\r\n
CVSS Score: 3.8
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
\r\nCWE-20 – Improper Input Validation\r\n\r\n
\r\n\r\n
\r\n\r\nSonicWall strongly advises users of the Email Security products (ES Appliance 5000, 5050, 7000, 7050, 9000, VMWare and Hyper-V) to upgrade to the mentioned fixed release version to address these vulnerabilities.
There is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild.
| \r\n Affected\r\n Product(s) \r\n | \r\n \r\n Affected\r\n Versions | \r\n
| \r\n Email Security | \r\n \r\n 10.0.34.8215, 10.0.34.8223 and earlier versions. | \r\n
1) CVE-2026-66149 - Improper Control of Generation of Code ('Code Injection') Vulnerability via netmask
Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask.\r\n
CVSS Score: 7.8
\r\nCVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
\t\t\r\nCWE-94: Improper Control of Generation of Code ('Code Injection')\r\n
\r\n\r\n
2) CVE-2026-66150 - Improper Control of Generation of Code ('Code Injection') Vulnerability via SNMP
Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP.\r\n
CVSS Score: 7.8
\r\nCVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
\r\nCWE-94: Improper Control of Generation of Code ('Code Injection')\r\n\r\n
\r\n\r\n
\r\n\r\nSonicWall strongly advises users of the Email Security products (ES Appliance 5000, 5050, 7000, 7050, 9000, VMWare and Hyper-V) to upgrade to the mentioned fixed release version to address these vulnerabilities.
There is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild.
| \r\n Affected\r\n Product(s) \r\n | \r\n \r\n Affected\r\n Versions | \r\n
| \r\n Email Security | \r\n \r\n 10.0.35.8405 and earlier versions. | \r\n
SonicWall Email Security 6.1.1
SonicWall Email Security 6.2
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Email Security Appliances","id":18},{"name":"Hosted Email Security","id":20}]},{"advisory_id":"SNWLID-2024-0006","title":"SonicWall Email Security Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) Vulnerability","published_when":"2024-03-12T23:34:23Z","last_updated_when":"2024-03-12T23:34:23Z","impact":"medium","cvss":"4.9","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","cvss_version":3.0,"cwe":"CWE-22","cve":"CVE-2024-22398","is_workaround_available":false,"summary":"An improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in SonicWall Email Security Appliance could allow a remote attacker with administrative privileges to conduct a directory traversal attack and delete arbitrary files from the appliance file system.","affected_products":"10.0.26.7807 and earlier versions.","vuln_status":"Applicable","patterns":[{"pattern":"^(?:[0-9]\\.\\d+\\.\\d+\\.\\d+|10\\.0\\.(?:[0-9]|1\\d|2[0-5])\\.\\d+|10\\.0\\.26\\.(?:[0-9]|[1-9]\\d|[1-9]\\d{2}|[1-6]\\d{3}|7[0-7]\\d{2}|780[0-6])|10\\.0\\.26\\.7807)$","name":"Email Security Appliances","id":18}],"vulnerable_products":[{"name":"Email Security Appliances","id":18}]},{"advisory_id":"SNWLID-2023-0002","title":"SonicWall Email Security Information Discloser Vulnerability","published_when":"2023-02-13T21:59:15Z","last_updated_when":"2023-02-13T21:59:15Z","impact":"medium","cvss":"4.3","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_version":3.0,"cwe":"CWE-209","cve":"CVE-2023-0655","is_workaround_available":false,"summary":"SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes sensitive information about users email addresses.
","affected_products":"Email Security 10.0.19.7431 and earlier versions","vuln_status":"Applicable","patterns":[{"pattern":"^(?:[0-9]\\.\\d+\\.\\d+\\.\\d+|10\\.0\\.(?:[0-9]|1[0-8])\\.\\d+|10\\.0\\.19\\.(?:[0-9]|[1-9]\\d|[1-9]\\d{2}|[1-6]\\d{3}|7[0-3]\\d{2}|74[0-2]\\d|7430)|10\\.0\\.19\\.7431)$","name":"Email Security Appliances","id":18}],"vulnerable_products":[{"name":"Email Security Appliances","id":18}]},{"advisory_id":"SNWLID-2021-0008","title":"SonicWall Email Security post-authentication arbitrary file creation vulnerability","published_when":"2021-04-09T22:03:27Z","last_updated_when":"2021-04-09T22:03:27Z","impact":"medium","cvss":"6.7","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H","cvss_version":3.0,"cwe":"CWE-434","cve":"CVE-2021-20022","is_workaround_available":false,"summary":"SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.","affected_products":"SonicWall On-premise Email Security (ES) 10.0.9 and earlier versions, Hosted Email Security (HES) 10.0.9 and earlier versions","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Email Security Appliances","id":18},{"name":"Hosted Email Security","id":20}]},{"advisory_id":"SNWLID-2021-0010","title":"SonicWall Email Security post-authentication arbitrary file read vulnerability","published_when":"2021-04-20T11:12:49Z","last_updated_when":"2021-04-20T11:12:49Z","impact":"medium","cvss":"6.7","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H","cvss_version":3.0,"cwe":"CWE-22","cve":"CVE-2021-20023","is_workaround_available":false,"summary":"SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.","affected_products":"SonicWall On-premise Email Security (ES) 10.0.9 and earlier versions, Hosted Email Security (HES) 10.0.9 and earlier versions","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Email Security Appliances","id":18},{"name":"Hosted Email Security","id":20}]},{"advisory_id":"SNWLID-2021-0007","title":"SonicWall Email Security pre-authentication administrative account creation vulnerability","published_when":"2021-04-09T17:12:09Z","last_updated_when":"2021-04-09T17:12:09Z","impact":"critical","cvss":"9.4","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","cvss_version":3.0,"cwe":"CWE-269","cve":"CVE-2021-20021","is_workaround_available":false,"summary":"A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.","affected_products":"SonicWall On-premise Email Security (ES) 10.0.9 and earlier versions, Hosted Email Security (HES) 10.0.9 and earlier versions","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Email Security Appliances","id":18},{"name":"Hosted Email Security","id":20}]},{"advisory_id":"SNWLID-2020-0007","title":"SonicWall Email Security Product version ES 10.0.7 and Comprehensive Anti-Spam Service 10.0.7 release discloses \"BCC\" email addresses in the email header","published_when":"2020-09-18T21:33:28Z","last_updated_when":"2020-09-18T21:33:28Z","impact":"medium","cvss":"5.3","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_version":3.0,"cwe":"CWE-359","cve":"N/A","is_workaround_available":true,"summary":"SonicWall On-premise Email Security (ES) 10.0.7, Hosted Email Security (HES) 10.0.7 products and Comprehensive Anti-Spam Service 10.0.7 release allow recipients of emails to potentially view the email addresses included in the “BCC” line if the recipient clicks on the header information of the email.","affected_products":"SonicWall On-premise Email Security (ES) 10.0.7, Hosted Email Security (HES) 10.0.7, and Comprehensive Anti-Spam Service 10.0.7 release.","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Comprehensive Anti-Spam Service","id":30},{"name":"Email Security Appliances","id":18},{"name":"Hosted Email Security","id":20}]},{"advisory_id":"SNWLID-2021-0012","title":"SonicWall Email Security Virtual Appliance Static Credential Vulnerability","published_when":"2021-05-13T14:00:23Z","last_updated_when":"2021-05-13T14:00:23Z","impact":"high","cvss":"8.4","cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-798","cve":"CVE-2021-20025","is_workaround_available":false,"summary":"SonicWall physical firewall appliances running certain versions of SonicOS contain vulnerabilities in code utilized for remote management. At this time, there is no indication that the discovered vulnerabilities are being exploited in the wild, however:
SonicWall STRONGLY advises to apply the SonicOS patch immediately.
IF you cannot update immediately, as a mitigation please restrict SonicWall management access (HTTPS/HTTP/SSH) to trusted sources and/or disable management access from untrusted Internet sources, then apply the SonicOS patch as soon as possible.
Note:
SonicWall will communicate future updates via this Security Advisory and SonicWall PSIRT Advisory SNWLID-2019-0009
sonicwall firmware 6.4.0.1
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"SonicOS Gen6 Platform - TZ/NSa/SM/NSv","id":2}]},{"advisory_id":"SNWLID-2018-0003","title":"SonicWall Global Management System (GMS) 8.1 cross-site scripting","published_when":"2018-01-14T04:29:00Z","last_updated_when":"2018-03-12T17:31:00Z","impact":"Medium","cvss":"5.4","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_version":3.0,"cwe":"CWE-79","cve":"CVE-2018-5691","is_workaround_available":false,"summary":"SonicWall Global Management System (GMS) 8.1 has XSS via the `newName` and `Name` values of the `/sgms/TreeControl` module.","affected_products":"SonicWall Global Management System (GMS) 8.4, 8.3, 8.2, 8.1, 7.X
SonicWall Analyzer 8.4, 8.3, 8.2, 8.1, 7.X
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Global Management System (GMS)","id":19}]},{"advisory_id":"SNWLID-2019-0004","title":"SonicWall Global Management System (GMS) Deprecated SSH keys Vulnerability","published_when":"2019-04-11T11:00:00Z","last_updated_when":"2019-04-26T11:00:00Z","impact":"high","cvss":"8.1","cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-284","cve":"CVE-2019-7476","is_workaround_available":false,"summary":"SonicWall Global Management System (GMS) 9.1
SonicWall Global Management System (GMS) 9.0
SonicWall Global Management System (GMS) 8.7
SonicWall Global Management System (GMS) 8.6
SonicWall Global Management System (GMS) 8.4
SonicWall Global Management System (GMS) 8.3 and earlier
Affected Product | Affected Version(s) |
SonicWall Global VPN Client (GVC) | 4.10.8.1108 and earlier versions |
SonicWall Global VPN client version 4.10.6 (32-bit and 64-bit) and earlier have a DLL Search Order Hijacking vulnerability. Successful exploitation via a local attacker could result in remote code execution in the target system.
IMPORTANT: At the time of advisory, there is no evidence to suggest that this vulnerability is being exploited in the wild.
","affected_products":"| \r\n Impacted\r\n Platform | \r\n \r\n Impacted\r\n Version | \r\n
| \r\n Global\r\n VPN Client | \r\n \r\n Global\r\n VPN Client (32-bit & 64-bit) version 4.10.6 (32-bit & 64-bit) &\r\n earlier | \r\n
SonicWall Global VPN Client (GVC) versions before 4.0.0.830
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Global VPN Client","id":9}]},{"advisory_id":"SNWLID-2020-0020","title":"SonicWall Global VPN client version 4.10.4.0314 and earlier allows privilege elevation through loaded process hijacking vulnerability","published_when":"2020-10-28T09:31:38Z","last_updated_when":"2020-10-28T09:31:38Z","impact":"high","cvss":"7.1","cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","cvss_version":3.0,"cwe":"CWE-426","cve":"CVE-2020-5144","is_workaround_available":false,"summary":"SonicWall Global VPN client version 4.10.4.0314 and earlier allows unprivileged windows user to elevate privileges to SYSTEM through loaded process hijacking vulnerability.","affected_products":"SonicWall Global VPN Client version 4.10.4.0314 and earlier","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Global VPN Client","id":9}]},{"advisory_id":"SNWLID-2020-0021","title":"SonicWall Global VPN client version 4.10.4.0314 and earlier have an insecure library loading (DLL hijacking) vulnerability","published_when":"2020-10-28T09:39:18Z","last_updated_when":"2020-10-28T09:39:18Z","impact":"high","cvss":"8.5","cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H","cvss_version":3.0,"cwe":"CWE-427","cve":"CVE-2020-5145","is_workaround_available":false,"summary":"SonicWall Global VPN client version 4.10.4.0314 and earlier have an insecure library loading (DLL hijacking) vulnerability. Successful exploitation could lead to remote code execution in the target system.","affected_products":"SonicWall Global VPN Client version 4.10.4.0314 and earlier","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Global VPN Client","id":9}]},{"advisory_id":"SNWLID-2021-0009","title":"SonicWall GMS 9.3 unauthenticated remote command execution vulnerability","published_when":"2021-04-10T01:08:27Z","last_updated_when":"2021-04-10T01:08:27Z","impact":"critical","cvss":"9.8","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-287","cve":"CVE-2021-20020","is_workaround_available":false,"summary":"A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root.","affected_products":"GMS 9.3 and earlier versions","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Global Management System (GMS)","id":19}]},{"advisory_id":"SNWLID-2023-0010","title":"SonicWall GMS and Analytics affected by multiple vulnerabilities","published_when":"2023-07-12T14:41:39Z","last_updated_when":"2023-07-12T14:41:39Z","impact":"critical","cvss":"9.8","cvss_vector":null,"cvss_version":3.0,"cwe":null,"cve":null,"is_workaround_available":false,"summary":"SonicWall GMS and Analytics products are affected by critical, high, and medium severity vulnerabilities. While it is important to note that there is currently no evidence of exploitation, SonicWall strongly recommends that organizations running older versions of GMS and Analytics builds upgrade to newer fixed versions.
| \r\n CVE | \r\n \r\n Description | \r\n \r\n CVSS | \r\n \r\n CWE | \r\n \r\n Vector | \r\n
| \r\n CVE-2023-34123 | \r\n \r\n Predictable\r\n Password Reset Key | \r\n \r\n 7.5 | \r\n \r\n CWE-321: Use of Hard-coded\r\n Cryptographic Key | \r\n \r\n \r\n | \r\n
| \r\n CVE-2023-34124 | \r\n \r\n Web\r\n Service Authentication Bypass | \r\n \r\n 9.4 | \r\n \r\n CWE-305: Authentication Bypass by\r\n Primary Weakness | \r\n \r\n \r\n | \r\n
| \r\n CVE-2023-34125 | \r\n \r\n Post-Authenticated\r\n Arbitrary File Read via Backup File Directory Traversal | \r\n \r\n 6.5 | \r\n \r\n CWE-27: Path Traversal:\r\n 'dir/../../filename' | \r\n \r\n \r\n | \r\n
| \r\n CVE-2023-34126 | \r\n \r\n Post-Authenticated\r\n Arbitrary File Upload | \r\n \r\n 7.1 | \r\n \r\n CWE-434: Unrestricted Upload of File\r\n with Dangerous Type | \r\n \r\n \r\n | \r\n
| \r\n CVE-2023-34127 | \r\n \r\n Post-Authenticated\r\n Command Injection | \r\n \r\n 8.8 | \r\n \r\n CWE-78: Improper Neutralization of\r\n Special Elements used in an OS Command ('OS Command Injection') | \r\n \r\n \r\n | \r\n
| \r\n CVE-2023-34128 | \r\n \r\n Hardcoded\r\n Tomcat Credentials (Privilege Escalation) | \r\n \r\n 6.5 | \r\n \r\n CWE-260: Password in Configuration\r\n File | \r\n \r\n \r\n | \r\n
| \r\n CVE-2023-34129 | \r\n \r\n Post-Authenticated\r\n Arbitrary File Write via Web Service (Zip Slip) | \r\n \r\n 7.1 | \r\n \r\n CWE-22: Improper Limitation of a\r\n Pathname to a Restricted Directory ('Path Traversal') | \r\n \r\n \r\n | \r\n
| \r\n CVE-2023-34130 | \r\n \r\n Use of\r\n Outdated Cryptographic Algorithm with Hardcoded Key | \r\n \r\n 5.3 | \r\n \r\n CWE-327: Use of a Broken or Risky\r\n Cryptographic Algorithm | \r\n \r\n \r\n | \r\n
| \r\n CVE-2023-34131 | \r\n \r\n Unauthenticated\r\n Sensitive Information Leak | \r\n \r\n 5.3 | \r\n \r\n CWE-200: Exposure of Sensitive\r\n Information to an Unauthorized Actor | \r\n \r\n \r\n | \r\n
| \r\n CVE-2023-34132 | \r\n \r\n Client-Side\r\n Hashing Function Allows Pass-the-Hash | \r\n \r\n 4.9 | \r\n \r\n CWE-836: Use of Password Hash\r\n Instead of Password for Authentication | \r\n \r\n \r\n | \r\n
| \r\n CVE-2023-34133 | \r\n \r\n Multiple\r\n Unauthenticated SQL Injection Issues & Security Filter Bypass | \r\n \r\n 9.8 | \r\n \r\n CWE-89: Improper Neutralization of\r\n Special Elements used in an SQL Command ('SQL Injection') | \r\n \r\n \r\n | \r\n
| \r\n CVE-2023-34134 | \r\n \r\n Password\r\n Hash Read via Web Service | \r\n \r\n 9.8 | \r\n \r\n CWE-200: Exposure of Sensitive\r\n Information to an Unauthorized Actor | \r\n \r\n \r\n | \r\n
| \r\n CVE-2023-34135 | \r\n \r\n Post\r\n Authenticated Arbitrary File Read via Web Service | \r\n \r\n 6.5 | \r\n \r\n CWE-36: Absolute Path Traversal | \r\n \r\n \r\n | \r\n
| \r\n CVE-2023-34136 | \r\n \r\n Unauthenticated\r\n File Upload | \r\n \r\n 6.5 | \r\n \r\n CWE-434: Unrestricted Upload of File\r\n with Dangerous Type | \r\n \r\n \r\n | \r\n
| \r\n CVE-2023-34137 | \r\n \r\n CAS Authentication\r\n Bypass | \r\n \r\n 9.4 | \r\n \r\n CWE-305: Authentication Bypass by\r\n Primary Weakness | \r\n \r\n \r\n | \r\n
","affected_products":"
GMS - Virtual Appliance 9.3.2-SP1 and earlier versions
GMS - Windows 9.3.2-SP1 and earlier versions
Analytics - 2.5.0.4-R7 and earlier versions
","vuln_status":"Applicable","patterns":[{"pattern":"^(?:[0-1]\\.\\d+\\.\\d+\\.\\d+-R\\d+|2\\.[0-4]\\.\\d+\\.\\d+-R\\d+|2\\.5\\.0\\.[0-3]-R\\d+|2\\.5\\.0\\.4-R[0-6]|2\\.5\\.0\\.4-R7)$","name":"Analytics","id":12},{"pattern":"^(?:[0-8]\\.\\d+\\.\\d+-SP\\d+|9\\.[0-2]\\.\\d+-SP\\d+|9\\.3\\.[0-1]-SP\\d+|9\\.3\\.2-SP0|9\\.3\\.2-SP1)$","name":"Global Management System (GMS)","id":19}],"vulnerable_products":[{"name":"Analytics","id":12},{"name":"Global Management System (GMS)","id":19}]},{"advisory_id":"SNWLID-2026-0011","title":"SonicWall GMS Security Affected By Multiple Vulnerabilities","published_when":"2026-08-11T13:23:57Z","last_updated_when":"2026-08-11T13:23:57Z","impact":"critical","cvss":"9.4","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","cvss_version":3.0,"cwe":"CWE-94","cve":"CVE-2026-66145, CVE-2026-66146, CVE-2026-66147, CVE-2026-66148","is_workaround_available":false,"summary":"SonicWall GMS (Virtual Appliance, Windows) - 9.5.1 and earlier versions are vulnerable to the following security issues.
While it is crucial to highlight that SonicWall Analytics products remain unaffected by these vulnerabilities. Additionally, there is no substantiated evidence to suggest that these vulnerabilities are currently being actively exploited in real-world scenarios.
SonicWall strongly recommends that organizations running older versions of GMS builds upgrade to newer fixed versions.
Affected Product | Affected Version(s) |
GMS - Virtual Appliance and Windows | 9.5.1 and earlier versions |
A vulnerability in lack of validation of user-supplied parameters pass to XML-RPC calls on SonicWall Global Management System (GMS) virtual appliance's, allow remote user to execute arbitrary code. This vulnerability affected GMS version 8.1 and earlier.
1) CVE-2026-66152 - SonicWall NetExtender arbitrary file write via path traversal vulnerability
A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root.\r\n
CVSS Score: 8.8
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
\r\nCWE-29: Path Traversal: '\\..\\filename'\r\n\r\n
\r\n\r\n
2) CVE-2026-66153 - SonicWall NetExtender Improper Link Resolution Before File Access ('Link Following') Vulnerability
The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths.\r\n
CVSS Score: 7.0
\r\nCVSS Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/MAC:H
\r\nCWE-59: Improper Link Resolution Before File Access ('Link Following')
\r\n\r\n
\r\n\r\nThere is no evidence that these vulnerabilities are being exploited in the wild. SonicWall strongly advises users of the NetExtender Linux client to upgrade to the mentioned fixed release version to address these vulnerabilities.
","affected_products":"Affected Product | Affected Version(s) |
NetExtender Linux Client | Version 10.3.5 and earlier versions |
Affected Product | Affected Version(s) |
NetExtender Windows (32 and 64 bit) | Version 10.3.0 |
1) CVE-2025-23008 - SonicWall NetExtender Improper Privilege Management Vulnerability
An improper privilege management vulnerability in the SonicWall NetExtender Windows (32 and 64 bit) client allows a low privileged attacker to modify configurations.\r\n
CVSS Score: 7.2
\r\nCVSS Vector: CVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
\r\nCWE-250: Execution with Unnecessary Privileges\r\n\r\n
\r\n\r\n
2) CVE-2025-23009 - SonicWall NetExtender Local Privilege Escalation Vulnerability
A local privilege escalation vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows an attacker to trigger an arbitrary file deletion.\r\n
CVSS Score: 5.9
\r\nCVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
\r\nCWE-250: Execution with Unnecessary Privileges\r\n\r\n
3) CVE-2025-23010 - SonicWall NetExtender Improper Link Resolution Before File Access ('Link Following')
An Improper Link Resolution Before File Access ('Link Following') vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows an attacker to manipulate file paths.\r\n
There is no evidence that these vulnerabilities are being exploited in the wild. SonicWall strongly advises users of the NetExtender Windows (32 and 64 bit) client to upgrade to the mentioned fixed release version to address these vulnerabilities.
","affected_products":"Affected Product | Affected Version(s) |
NetExtender Windows (32 and 64 bit) | Version 10.3.1 and earlier versions |
\r\n\r\n
1) CVE-2026-78327 - Authenticated Command Injection Vulnerability
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution.\r\n
CVSS Score: 9.1
\r\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
\t\t\r\nCWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\r\n
\r\n\r\n
2) CVE-2026-78328 - Privilege Escalation from Admin to SuperAdmin Vulnerability
A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.\r\n
CVSS Score: 7.2
\r\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
\r\nCWE-862: Missing Authorization\r\n\r\n
\r\n\r\n
3) CVE-2026-81939 - Zip Slip Vulnerability
A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive.\r\n
CVSS Score: 9.1
\r\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
\t\t\r\nCWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\r\n
\r\n\r\n
\r\n\r\nSonicWall strongly advises users of the Network Security Manager (NSM) On-Prem (VMWare, Hyper-V, Azure and KVM) to upgrade to the mentioned fixed release version to address these vulnerabilities.
There is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild and NSM SaaS versions are not affected by these vulnerabilities.
| \r\n Affected\r\n Product(s) \r\n | \r\n \r\n Affected\r\n Versions | \r\n
| \r\n Network Security Manager (NSM) On-Prem | \r\n \r\n 4.3.0 and earlier versions. | \r\n
NSM SaaS versions are not affected by these vulnerabilities.
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Network Security Manager","id":21}]},{"advisory_id":"SNWLID-2026-0018","title":"SonicWall NSM On-Prem Affected By Multiple Vulnerabilities","published_when":"2026-10-14T06:50:58Z","last_updated_when":"2026-10-14T06:50:58Z","impact":"high","cvss":"8.8","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-863, CWE-78","cve":"CVE-2026-96540, CVE-2026-100232","is_workaround_available":false,"summary":"1) CVE-2026-96540 - SonicWall NSM On-Prem Improper Access Control Vulnerability
An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escalate privileges to an administrator or to intercept communications of other users of the NSM instance.
CVSS Score: 8.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-863: Incorrect Authorization
\r\n\r\n
2) CVE-2026-100232 - SonicWall NSM On-Prem Authenticated OS Command Injection Vulnerability
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute arbitrary OS commands, resulting in remote code execution.
CVSS Score: 7.2
\r\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-78: Improper Neutralization of Special Elements used in an OS Command
SonicWall strongly advises users of the Network Security Manager (NSM) On-Prem (VMWare, Hyper-V, Azure and KVM) to upgrade to the mentioned fixed release version to address these vulnerabilities.
\r\nThere is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild and NSM SaaS versions are not affected by these vulnerabilities.
| \r\n Affected\r\n Product(s) \r\n | \r\n \r\n Affected\r\n Versions \r\n | \r\n
| \r\n Network Security Manager (NSM) On-Prem | \r\n \r\n 4.3.1 and earlier versions \r\n | \r\n
NSM SaaS versions are not affected by this vulnerability.
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Network Security Manager","id":21}]},{"advisory_id":"SNWLID-2021-0014","title":"SonicWall NSM On-Prem authenticated command injection vulnerability","published_when":"2021-05-27T14:07:54Z","last_updated_when":"2021-05-27T14:07:54Z","impact":"high","cvss":"8.8","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-78","cve":"CVE-2021-20026","is_workaround_available":false,"summary":"A vulnerability in the SonicWall NSM On-Prem product allows an authenticated attacker to perform OS command injection using a crafted HTTP request. This vulnerability affects NSM On-Prem 2.2.0-R10 and earlier versions.","affected_products":"NSM On-Prem 2.2.0-R10 and earlier versions
NSM SaaS versions are not affected by this vulnerability
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Network Security Manager","id":21}]},{"advisory_id":"SNWLID-2022-0023","title":"SonicWall OpenSSL Version 3.x Security Advisory","published_when":"2022-11-01T22:49:21Z","last_updated_when":"2022-11-01T22:49:21Z","impact":"high","cvss":"7.5","cvss_vector":null,"cvss_version":3.0,"cwe":"CWE-476, CWE-121","cve":"CVE-2022-3358, CVE-2022-3602 and CVE-2022-3786","is_workaround_available":false,"summary":"This advisory is intended to cover the following OpenSSL Vulnerabilities
\r\n
CVE-2022-3358 - Using a Custom Cipher with NID_undef may lead to NULL encryption
Fixed in OpenSSL 3.0.6 (Affected OpenSSL Versions 3.x, 3.0.0-3.0.5).
More vulnerability details are available here https://www.openssl.org/news/secadv/20221011.txt
CVE-2022-3602 - X.509 Email Address 4-byte Buffer Overflow
Fixed in OpenSSL 3.0.7 (Affected OpenSSL Versions 3.x, 3.0.0-3.0.6).
More vulnerability details are available here https://www.openssl.org/news/secadv/20221101.txt
CVE-2022-3786 - X.509 Email Address Variable Length Buffer Overflow
Fixed in OpenSSL 3.0.7 (Affected OpenSSL Versions 3.x, 3.0.0-3.0.6).
More vulnerability details are available here https://www.openssl.org/news/secadv/20221101.txt
","affected_products":"After review, it has been determined that the vulnerable branch of OpenSSL (3.x) is not utilized in the SonicWall product suite, therefore the vulnerabilities in scope for this advisory have been determined to be 'Not Applicable'.
\r\nProduct | Affected Version(s) |
SMA100: SMA 500v (ESX, KVM, Hyper-V, AWS, Azure) | Not Applicable |
SMA1000: SMA 6200/7200/6210/7210 SMA 8200v (ESX, KVM, Hyper-V, AWS, Azure) | Not Applicable |
SonicOS Gen6: SOHO/SOHO-W, SOHO-250 TZ300/W; TZ350/W TZ400/W TZ500/W TZ600 NSA 2600/2650/3600/3650/4600/4650/5600/5650/6600/6650 SM 9200/9400/9600/9800 NSa 9250/9450/9650 NSSP 12400/12800 NSV 10/25/50/100/200/400/800/1600 (ESX, KVM, HYPER-V, AWS, Azure) | Not Applicable |
SonicOS Gen7: TZ270/W TZ370/W TZ470/W TZ570/W TZ670 NSA 2700/3700/4700/5700/6700 NSSP 10700/11700/13700/15700 NSV 270/470/870 (ESX, KVM, HYPER-V, AWS, Azure) | Not Applicable |
GMS | Not Applicable |
Analytics | Not Applicable |
NSM | Not Applicable |
Capture Security Appliance | Not Applicable |
Capture Client | Not Applicable |
Email Security | Not Applicable |
NetExtender Client | Not Applicable |
Connect Tunnel Client | Not Applicable |
SonicWall Switch SWS 12-8/12-8POE SWS 12-10FPOE SWS 14-24/14-24FPOE SWS 14-48/14-48FPOE | Not Applicable |
SonicWave Access Points | Not Applicable |
Clients | Affected Version(s) |
NetExtender for Linux | Not Applicable |
NetExtender for Windows | Not Applicable |
Connect Tunnel v12.1 and earlier | Not Applicable |
Connect Tunnel v12.4 | Not Applicable |
Mobile Connect for MacOS | Not Applicable |
Mobile Connect for iOS | Not Applicable |
Mobile Connect for Android and ChromeOS | Not Applicable |
Global VPN Client (GVC) | Not Applicable |
SonicWall has verified and patched vulnerabilities of critical and\r\nmedium severity (CVSS 5.3-9.8) in SMA 100 series appliances, which include SMA 200,\r\n210, 400, 410 and 500v products. SMA 100 series appliances with WAF enabled are\r\nalso impacted by the majority of these vulnerabilities.
SonicWall strongly urges that organizations follow the guidance below\r\nto patch SMA 100 series products, which include SMA 200, 210, 400, 410 and 500v\r\nproducts.
\r\n\r\n\r\n\r\n\r\n\r\n
| \r\n Issue\r\n ID | \r\n \r\n Summary | \r\n \r\n CVE | \r\n \r\n CVSS | \r\n \r\n Reporting Party | \r\n
| \r\n SMA-3217 | \r\n \r\n Unauthenticated\r\n Stack-Based Buffer Overflow | \r\n \r\n CVE-2021-20038 | \r\n \r\n 9.8 | \r\n \r\n Rapid7 | \r\n
| \r\n SMA-3204 | \r\n \r\n Authenticated\r\n Command Injection | \r\n \r\n CVE-2021-20039 | \r\n \r\n 7.2 | \r\n \r\n Rapid7 | \r\n
| \r\n SMA-3206 | \r\n \r\n Unauthenticated\r\n File Upload Path Traversal | \r\n \r\n CVE-2021-20040 | \r\n \r\n 6.5 | \r\n \r\n Rapid7\r\n |NCCGroup | \r\n
| \r\n SMA-3207 | \r\n \r\n Unauthenticated\r\n CPU Exhaustion | \r\n \r\n CVE-2021-20041 | \r\n \r\n 7.5 | \r\n \r\n Rapid7 | \r\n
| \r\n SMA-3208 | \r\n \r\n Unauthenticated\r\n Confused Deputy | \r\n \r\n CVE-2021-20042 | \r\n \r\n 6.3 | \r\n \r\n Rapid7 | \r\n
| \r\n SMA-3231 | \r\n \r\n Heap-Based\r\n Buffer Overflow | \r\n \r\n CVE-2021-20043 | \r\n \r\n 8.8 | \r\n \r\n NCCGroup | \r\n
| \r\n SMA-3233 | \r\n \r\n Post-Authentication\r\n Remote Command Execution | \r\n \r\n CVE-2021-20044 | \r\n \r\n 7.2 | \r\n \r\n NCCGroup | \r\n
| \r\n SMA-3235 | \r\n \r\n Multiple\r\n Unauthenticated Heap-Based and Stack Based Buffer Overflow | \r\n \r\n CVE-2021-20045 | \r\n \r\n 9.4 | \r\n \r\n NCCGroup | \r\n
A critical severity vulnerability\r\n(CVSS 9.8) in SMA 100 appliances, which includes SMA 200, 210, 400, 410 and\r\n500v could allow a remote unauthenticated attacker to cause Stack-based Buffer\r\nOverflow and would result in code execution as the nobody user in the SMA100\r\nappliance. It\r\nwas noticed that the SMA 100 users with licensed/enabled WAF are impacted by\r\nthis vulnerability.
The Vulnerability is due to the SonicWall\r\nSMA SSLVPN Apache httpd server GET method of mod_cgi module environment\r\nvariables use a single stack-based buffer using `strcat`. This allows remote attacker to\r\ncause Stack-based Buffer Overflow and would result in code execution.
There is no evidence that this\r\nvulnerability is being exploited in the wild.
SonicWall strongly urges that\r\norganizations follow the guidance below to patch SMA 100 series products, which\r\ninclude SMA 200, 210, 400, 410 and 500v.
IMPACT:
As outlined in SNWLID-2021-0026,\r\nsuccessfully leveraging CVE-2021-20038 against\r\nimpacted SMA 100 devices can result in the remote attacker being able to initiate the stack based buffer overflow which can potentially lead to code execution in the device.
| \r\n Impacted\r\n Platforms | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv | \r\n
A high severity vulnerability (CVSS 7.2)\r\nin SMA 100 appliances, which includes SMA 200, 210, 400, 410 and 500v could\r\nallow remote unauthenticated attacker to execute arbitrary commands in the SMA\r\n100 appliance as root user. This can potentially lead to the remote\r\nauthenticated attacker taking over the control of the SMA 100 appliance\r\nremotely. It was noticed that the SMA 100 users with licensed/enabled WAF are\r\nnot impacted by this vulnerability.
The Vulnerability is due to the SonicWall\r\nSMA SSLVPN `/cgi-bin/viewcert` POST http method which allows authenticated\r\nindividuals to upload, view, or delete SSL certificates. A remote authenticated\r\nattacker can execute arbitrary commands using this POST http method.
There is no evidence that this\r\nvulnerability is being exploited in the wild.
SonicWall strongly urges that\r\norganizations follow the guidance below to patch SMA 100 series products, which\r\ninclude SMA 200, 210, 400, 410 and 500v.
IMPACT:
As outlined in SNWLID-2021-0026,\r\nsuccessfully leveraging CVE-2021-20039 against\r\nimpacted SMA 100 devices can result in the remote authenticated attacker\r\nexecuting arbitrary commands in the SMA 100 appliance as root user resulting in\r\nthe remote takeover of the device.
| \r\n Impacted\r\n Platforms | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 9.0.0.11-31sv, 10.2.0.8-37sv, 10.2.1.1-19sv | \r\n
A medium severity vulnerability\r\n(CVSS 6.5) in SMA 100 appliances, which includes SMA 200, 210, 400, 410 and\r\n500v could allow remote unauthenticated attacker to upload arbitrary files.\r\nAttacker can upload crafted web pages to the web server's root directory or\r\nmalicious files to any directory in the appliance as a nobody user. It was observed that SMA 100\r\ndevices with WAF licensed/enabled are also impacted by this vulnerability.
This is due to the Path Traversal\r\nAttack Vulnerability. The Path traversal attacks vulnerability in SMA100 shares\r\nfunctionality that allows remote unauthenticated attacker to upload arbitrary\r\nfiles to any directory in the appliance.
There is no evidence that this vulnerability is being\r\nexploited in the wild.
SonicWall strongly urges that organizations follow the\r\nguidance below to patch SMA 100 series products, which include SMA 200, 210,\r\n400, 410 and 500v.
IMPACT:
As outlined in SNWLID-2021-0026,\r\nsuccessfully leveraging CVE-2021-20040 against\r\nimpacted SMA 100 devices can allow the remote unauthenticated attacker to\r\nupload arbitrary files. The attacker can upload crafted web pages to the\r\nweb server's root directory or malicious files to any directory in the\r\nappliance.
| \r\n Impacted\r\n Platforms | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.0.8-37sv, 10.2.1.1-19sv | \r\n
4. Security Notice:
SMA-3207 - SMA 100 Series Unauthenticated CPU Exhaustion Vulnerability (CVSS\r\n7.5)
A high severity vulnerability (CVSS 7.5) in SMA 100\r\nappliances, which includes SMA 200, 210, 400, 410 and 500v could allow an\r\nunauthenticated and remote adversary to consume all of the device’s CPU\r\npotentially causing DoS. It was observed that the SMA100 appliances with WAF\r\nlicensed/enabled are also impacted by this vulnerability.
The CPU exhaustion is due to the crafted HTTP requests sent\r\nto https://address/fileshare/sonicfiles/sonicfiles` resulting in an infinite\r\nloop in the `fileexplorer` process.
There is no evidence that this vulnerability is being\r\nexploited in the wild.
SonicWall strongly urges that organizations follow the\r\nguidance below to patch SMA 100 series products, which include SMA 200, 210,\r\n400, 410 and 500v.
IMPACT:
As outlined in SNWLID-2021-0026, successfully leveraging CVE-2021-20041 against\r\nimpacted SMA 100 devices can allow an unauthenticated and remote adversary to\r\nconsume all of the device’s CPU potentially causing DoS.
| \r\n Impacted\r\n Platforms | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 9.0.0.11-31sv, 10.2.0.8-37sv, 10.2.1.1-19sv | \r\n
5. Security Notice:
SMA-3208 - SMA 100 Series Unauthenticated \"Confused Deputy\"\r\nVulnerability (CVSS 6.3)
A medium severity vulnerability\r\n(CVSS 6.3) in SMA 100 appliances, which includes SMA 200, 210, 400, 410 and\r\n500v could allow a remote unauthenticated attacker to use SMA 100 series\r\ndevices as an \"unintended proxy or intermediary\" (aka Confused Deputy\r\n- see CWE-441). Outside attacker can use the SMA 100 as undetectable proxy to\r\nbypass firewall rules. It was observed that SMA 100 devices with WAF\r\nlicensed/enabled are also impacted by this vulnerability.
There is no evidence that this vulnerability is being\r\nexploited in the wild.
SonicWall strongly urges that organizations follow the\r\nguidance below to patch SMA 100 series products, which include SMA 200, 210,\r\n400, 410 and 500v.
IMPACT:
As outlined in SNWLID-2021-0026,\r\nsuccessfully leveraging CVE-2021-20042 against impacted SMA 100 devices\r\ncan allow the remote unauthenticated attacker to use SMA 100 series devices as\r\nan \"unintended proxy or intermediary\" (aka Confused Deputy - see CWE-441).\r\nThe outside attacker can use the SMA 100 as undetectable\r\nproxy to bypass firewall rules.
| \r\n Impacted\r\n Platforms | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 9.0.0.11-31sv, 10.2.0.8-37sv, 10.2.1.1-19sv | \r\n
6. Security Notice:
SMA-3231 - SMA 100 Series getBookmarks Heap-based Buffer Overflow (CVSS\r\n8.8)
A critical severity vulnerability\r\n(CVSS 8.8) in SMA 100 appliances, which includes SMA 200, 210, 400, 410 and 500v\r\ncould allow a Remote authenticated attacker can cause Heap-based Buffer\r\nOverflow and would result in code execution as the nobody user in the SMA100\r\nappliance. It was observed that the SMA100 appliances with WAF licensed/enabled\r\nare also impacted by this vulnerability.
This Vulnerability is due to the RAC_GET_BOOKMARKS_HTML5\r\n(RacNumber 35) method that allows users to list their bookmarks. This method is\r\nvulnerable to heap-based buffer-overflow, due to unchecked use of strcat. So remote\r\nauthenticated attacker can cause Heap-based Buffer Overflow and would result in\r\ncode execution as the nobody user in the SMA100 appliance.
There is no evidence that this\r\nvulnerability is being exploited in the wild.
SonicWall strongly urges that\r\norganizations follow the guidance below to patch SMA 100 series products, which\r\ninclude SMA 200, 210, 400, 410 and 500v.
IMPACT:
As outlined in SNWLID-2021-0026, successfully leveraging CVE-2021-20043 against impacted SMA 100\r\ndevices can allow a Remote authenticated attacker can cause Heap-based Buffer\r\nOverflow and would result in code execution as the nobody user in the SMA100 appliance.
| \r\n Impacted\r\n Platforms | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.0.8-37sv, 10.2.1.1-19sv | \r\n
7. Security Notice:
SMA-3233 - SMA 100 Series POST-Authentication Remote Code Execution (RCE)\r\n(CVSS 7.2)
A high severity vulnerability\r\n(CVSS 7.2) in SMA 100 appliances, which includes SMA 200, 210, 400, 410 and\r\n500v could allow a Remote authenticated attacker to execute system commands as\r\n‘nobody’, the attacker can modify/delete files in the cgi-bin directory and\r\nalso able to reboot system remotely. It was observed that the SMA100 appliances\r\nwith WAF licensed/enabled are also impacted by this vulnerability.
This Vulnerability is due to an\r\nexposed Management API which is written in Python Flask. Remote authenticated\r\nattacker can execute system commands as ‘nobody’ user in the SMA100 appliance.
There is no evidence that this\r\nvulnerability is being exploited in the wild.
SonicWall strongly urges that\r\norganizations follow the guidance below to patch SMA 100 series products, which\r\ninclude SMA 200, 210, 400, 410 and 500v.
IMPACT:
As outlined in SNWLID-2021-0026,\r\nsuccessfully leveraging CVE-2021-20044 against impacted SMA 100 devices could\r\nallow a Remote authenticated attacker to execute system commands as ‘nobody’,\r\nthe attacker can modify/delete files in the cgi-bin directory and also able to\r\nreboot system remotely.
| \r\n Impacted\r\n Platforms | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.0.8-37sv, 10.2.1.1-19sv | \r\n
8. Security Notice:
SMA-3235 - Multiple SMA 100 Unauthenticated File Explorer Heap-based and\r\nStack-based Buffer Overflows (CVSS 9.4)
A critical severity vulnerability\r\n(CVSS 9.4) in SMA 100 appliances, which includes SMA 200, 210, 400, 410 and\r\n500v could allow a remote unauthenticated attacker to cause Heap-based and\r\nStack-based Buffer Overflow and would result in code execution as the nobody\r\nuser in the SMA100 appliance. It was observed that the SMA100 appliances with\r\nWAF licensed/enabled are also impacted by this vulnerability. Exploitation\r\npotentially leading to code execution.
This Vulnerability is due to the sonicfiles\r\nRAC_COPY_TO (RacNumber 36) method which allows users to upload files to an SMB\r\nshare and can be called without any authentication. RacNumber 36 of the\r\nsonicfiles API maps to the upload_file Python method and this is associated\r\nwith filexplorer binary, which is a custom program written in C++ which is\r\nvulnerable to a number of memory safety issues.
There is no evidence that this\r\nvulnerability is being exploited in the wild.
SonicWall strongly urges that\r\norganizations follow the guidance below to patch SMA 100 series products, which\r\ninclude SMA 200, 210, 400, 410 and 500v.
IMPACT:
As outlined in SNWLID-2021-0026,\r\nsuccessfully leveraging CVE-2021-20045 against impacted SMA 100 devices could\r\nallow a remote unauthenticated attacker to cause Heap-based and Stack-based\r\nBuffer Overflow and would result in code execution as the nobody user in the\r\nSMA100 appliance.
| \r\n Impacted\r\n Platforms | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.0.8-37sv, 10.2.1.1-19sv | \r\n
\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
| \r\n · \r\n Impacted\r\n Platform: SMA 100 Series | \r\n |||||
| \r\n ISSUE\r\n ID | \r\n \r\n Summary\r\n | \r\n \r\n CVSS\r\n Score | \r\n \r\n Impacted\r\n Firmware | \r\n \r\n Fixed\r\n Firmware | \r\n \r\n CVE | \r\n
| \r\n SMA\r\n 3217 | \r\n \r\n Critical\r\n SMA 100 Series Unauthenticated Stack-based Buffer Overflow \r\n \r\n \r\n \r\n \r\n \r\n \r\n | \r\n \r\n 9.8 High | \r\n \r\n 10.2.1.0-17sv \r\n | \r\n \r\n 10.2.1.3-27sv | \r\n \r\n CVE-2021-20038 | \r\n
| \r\n 10.2.1.1-19sv \r\n | \r\n \r\n 10.2.1.3-27sv | \r\n ||||
| \r\n 10.2.1.2-24sv \r\n | \r\n \r\n 10.2.1.3-27sv | \r\n ||||
| \r\n SMA\r\n 3204 | \r\n \r\n SMA 100 Series Authenticated Command\r\n Injection Vulnerability as Root | \r\n \r\n \r\n 7.2\r\n High | \r\n \r\n 9.0.0.11-31sv* | \r\n \r\n 10.2.0.9-41sv\r\n | \r\n \r\n CVE-2021-20039 | \r\n
| \r\n 10.2.0.8-37sv | \r\n \r\n 10.2.0.9-41sv | \r\n ||||
| \r\n 10.2.1.1\r\n -19sv | \r\n \r\n 10.2.1.3-27sv | \r\n ||||
| \r\n SMA\r\n 3206 | \r\n \r\n Unauthenticated File Upload Path Traversal Vulnerability | \r\n \r\n 6.5\r\n Medium | \r\n \r\n 10.2.0.8-37sv | \r\n \r\n \r\n 10.2.0.9-41sv | \r\n \r\n CVE-2021-20040 | \r\n
| \r\n 10.2.1.1\r\n -19sv | \r\n \r\n 10.2.1.3-27sv | \r\n ||||
| \r\n SMA\r\n 3207 | \r\n \r\n Unauthenticated CPU Exhaustion Vulnerability | \r\n \r\n 7.5\r\n High | \r\n \r\n 9.0.0.11-31sv* | \r\n \r\n 10.2.0.9-41sv\r\n | \r\n \r\n CVE-2021-20041 | \r\n
| \r\n \r\n 10.2.0.8-37sv | \r\n \r\n \r\n 10.2.0.9-41sv | \r\n ||||
| \r\n 10.2.1.1\r\n -19sv | \r\n \r\n 10.2.1.3-27sv | \r\n ||||
| \r\n SMA-3208 | \r\n \r\n Unauthenticated \"Confused Deputy\"\r\n Vulnerability | \r\n \r\n 6.3\r\n Medium | \r\n \r\n 9.0.0.11-31sv* | \r\n \r\n 10.2.0.9-41sv\r\n | \r\n \r\n CVE-2021-20042 | \r\n
| \r\n \r\n 10.2.0.8-37sv | \r\n \r\n \r\n 10.2.0.9-41sv | \r\n ||||
| \r\n 10.2.1.1\r\n -19sv | \r\n \r\n 10.2.1.3-27sv | \r\n ||||
| \r\n SMA-3231 | \r\n \r\n getBookmarks\r\n Heap-based Buffer Overflow | \r\n \r\n 8.8\r\n High | \r\n \r\n \r\n 10.2.0.8-37sv | \r\n \r\n \r\n 10.2.0.9-41sv | \r\n \r\n CVE-2021-20043 | \r\n
| \r\n 10.2.1.1\r\n -19sv | \r\n \r\n 10.2.1.3-27sv | \r\n ||||
| \r\n SMA-3233 | \r\n \r\n Post-Authentication Remote Code Execution\r\n (RCE) | \r\n \r\n 7.2\r\n High | \r\n \r\n \r\n 10.2.0.8-37sv | \r\n \r\n \r\n 10.2.0.9-41sv | \r\n \r\n CVE-2021-20044 | \r\n
| \r\n 10.2.1.1\r\n -19sv | \r\n \r\n 10.2.1.3-27sv | \r\n ||||
| \r\n SMA-3235 | \r\n \r\n Multiple SMA 100 Unauthenticated File\r\n Explorer Heap-based and Stack-based Buffer Overflows | \r\n \r\n 9.4\r\n High | \r\n \r\n \r\n 10.2.0.8-37sv | \r\n \r\n \r\n 10.2.0.9-41sv | \r\n \r\n CVE-2021-20045 | \r\n
| \r\n 10.2.1.1 -19sv | \r\n \r\n 10.2.1.3-27sv | \r\n
| \r\n Impacted\r\n Platforms | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 9.0.0.11-31sv* and earlier, 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier | \r\n
sonicwall pro100 6.4.0.1
sonicwall pro200 6.4.0.1
sonicwall pro300 6.4.0.1
","vuln_status":"Applicable"},{"advisory_id":"SNWLID-2025-0015","title":"SonicWall SMA100 10.2.2.2-92sv With Additional File Checking","published_when":"2025-09-22T18:27:38Z","last_updated_when":"2025-09-29T11:58:11Z","impact":"not_defined","cvss":"0.0","cvss_vector":"N/A","cvss_version":3.0,"cwe":"N/A","cve":"N/A","is_workaround_available":false,"summary":"SonicWall SMA 100 10.2.2.2-92sv build has been released with additional file checking, providing the capability to remove known rootkit malware present on the SMA devices. While this is a valuable security step and a necessary measure to protect our customers, it’s equally important to clarify that this does not change the established End-of-Support (EOS) timeline.\r\n
IMPORTANT: SonicWall strongly recommends that users of the SMA 100 series products (SMA 210, 410, and 500v) upgrade to the 10.2.2.2-92sv version.
\r\n\r\nAdditionally, the threat intelligence report from Google Threat Intelligence Group (GTIG) highlights potential risk of using older versions of SMA100 firmware. We strongly recommend that all organizations using SMA 100 Series appliances review and implement the security measures outlined in the KB article \r\nlinked below.
| \r\n Affected\r\n Product(s) \r\n | \r\n \r\n Affected\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.1.15-81sv and earlier versions. | \r\n
Note: This does not affect SonicWall SSL VPN SMA1000 series products or SSL-VPN running on SonicWall firewalls.
","vuln_status":"Not Applicable","patterns":[{"pattern":"^(?:[0-9]\\.\\d+\\.\\d+\\.\\d+-\\d+sv|10\\.[0-1]\\.\\d+\\.\\d+-\\d+sv|10\\.2\\.0\\.\\d+-\\d+sv|10\\.2\\.1\\.(?:[0-9]|1[0-4])-\\d+sv|10\\.2\\.1\\.15-(?:[0-9]|[1-7]\\d|80)sv|10\\.2\\.1\\.15-81sv)$","name":"Secure Mobile Access (SMA) 100 Series","id":4}],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2021-0030","title":"SonicWall SMA100 API username enumeration vulnerability","published_when":"2021-12-21T11:24:05Z","last_updated_when":"2021-12-21T11:24:05Z","impact":"medium","cvss":"5.3","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_version":3.0,"cwe":"CWE-204","cve":"CVE-2021-20049","is_workaround_available":false,"summary":"A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability affected 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x versions.","affected_products":"Vulnerability in SonicWall SMA100 NetExtender Windows (32 and 64-bit) client 10.2.339 and earlier versions allows an attacker to arbitrary code execution when processing an EPC Client update.
SonicWall strongly advises SSL VPN NetExtender client users to upgrade to the latest release version.
\r\n\r\nIMPORTANT: This vulnerability does not affect SonicWall firewall (SonicOS) products.","affected_products":"A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to cause Denial of Service (DoS) on the appliance or potentially lead to code execution. This vulnerability impacts 10.2.1.5-34sv and earlier versions.
IMPORTANT: SMA 1000 series products are not affected by this vulnerability.
An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution.\r\n
\r\n\r\nSonicWall strongly recommends that users of the SMA 100 series products (SMA 210, 410, and 500v) upgrade to the specified fixed release version to remediate this vulnerability.
","affected_products":"| \r\n Affected\r\n Product(s) \r\n | \r\n \r\n Affected\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.1.15-81sv and earlier versions. | \r\n
Note: This vulnerability does not affect SonicWall SSL VPN SMA1000 series products or SSL-VPN running on SonicWall firewalls.
","vuln_status":"Applicable","patterns":[{"pattern":"^(?:[0-9]\\.\\d+\\.\\d+\\.\\d+-\\d+sv|10\\.[0-1]\\.\\d+\\.\\d+-\\d+sv|10\\.2\\.0\\.\\d+-\\d+sv|10\\.2\\.1\\.(?:[0-9]|1[0-4])-\\d+sv|10\\.2\\.1\\.15-(?:[0-9]|[1-7]\\d|80)sv|10\\.2\\.1\\.15-81sv)$","name":"Secure Mobile Access (SMA) 100 Series","id":4}],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2021-0005","title":"SonicWall SMA100 post-authentication configuration export to the a specified email address","published_when":"2021-03-13T01:19:00Z","last_updated_when":"2021-03-13T01:19:00Z","impact":"medium","cvss":"6.1","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","cvss_version":3.0,"cwe":"CWE-200","cve":"CVE-2021-20018","is_workaround_available":false,"summary":"A post-authenticated vulnerability in SonicWall SMA100 allows an attacker to export the configuration file to the specified email address. This vulnerability impacts SMA100 version 10.2.0.5 and earlier.","affected_products":"SMA100 version 10.2.0.5 and earlier","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2025-0017","title":"SonicWall SMA100 Potential Exposure of Sensitive Information in Log File","published_when":"2025-10-30T10:40:02Z","last_updated_when":"2025-10-30T10:40:02Z","impact":"medium","cvss":"4.5","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","cvss_version":3.0,"cwe":"CWE-532","cve":"CVE-2025-40603","is_workaround_available":false,"summary":"A potential exposure of sensitive information in log files in SonicWall SMA100 Series appliances may allow a remote, authenticated administrator, under certain conditions to view partial users credential data.
SonicWall strongly recommends that users of the SMA 100 series products (SMA 210, 410, and 500v) upgrade to the specified fixed release version to remediate this vulnerability.
SonicWall PSIRT is not aware of active exploitation of this vulnerability in the wild. No reports of a PoC have been made public and malicious use of this vulnerability has not been reported to SonicWall.
","affected_products":"| \r\n Affected\r\n Product(s) \r\n | \r\n \r\n Affected\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.2.2-92sv and earlier versions. | \r\n
Note: This vulnerability does not affect SonicWall SSL VPN SMA1000 series products or SSL-VPN running on SonicWall firewalls.
","vuln_status":"Applicable","patterns":[{"pattern":"^(?:[0-9]\\.\\d\\.\\d\\.\\d-\\d{1,2}sv|10\\.[0-1]\\.\\d\\.\\d-\\d{1,2}sv|10\\.2\\.[0-1]\\.\\d-\\d{1,2}sv|10\\.2\\.2\\.[0-1]-\\d{1,2}sv|10\\.2\\.2\\.2-(?:[0-9]|[1-8]\\d|9[0-1])sv|10\\.2\\.2\\.2-92sv)$","name":"Secure Mobile Access (SMA) 100 Series","id":4}],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2019-0018","title":"SonicWall SMA100 Pre-authentication directory traversal","published_when":"2019-12-17T21:00:00Z","last_updated_when":"2020-03-06T04:42:49Z","impact":"high","cvss":"7.5","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_version":3.0,"cwe":"CWE-22","cve":"CVE-2019-7483","is_workaround_available":false,"summary":"In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.","affected_products":"SonicWall SMA100 9.0.0.3 and earlier","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2019-0016","title":"SonicWall SMA100 Pre-Authentication SQL Injection","published_when":"2019-12-17T20:00:00Z","last_updated_when":"2020-03-06T04:42:49Z","impact":"high","cvss":"7.5","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_version":3.0,"cwe":"CWE-89","cve":"CVE-2019-7481","is_workaround_available":false,"summary":"Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerability impacted SMA100 version 9.0.0.3 and earlier.","affected_products":"SonicWall SMA100 9.0.0.3 and earlier","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2019-0017","title":"SonicWall SMA100 Pre-authentication stack buffer overflow","published_when":"2019-12-17T21:00:00Z","last_updated_when":"2020-03-06T04:42:49Z","impact":"critical","cvss":"9.8","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-121","cve":"CVE-2019-7482","is_workaround_available":false,"summary":"Stack-based buffer overflow in SonicWall SMA100 allows an unauthenticated user to execute arbitrary code in function libSys.so. This vulnerability impacted SMA100 version 9.0.0.3 and earlier.","affected_products":"SonicWall SMA100 9.0.0.3 and earlier","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2024-0018","title":"SonicWall SMA100 SSL-VPN Affected By Multiple Vulnerabilities","published_when":"2024-12-03T20:31:54Z","last_updated_when":"2025-07-31T16:36:36Z","impact":"critical","cvss":"9.8","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-35, CWE-121, CWE-122, CWE-798, CWE-338","cve":"CVE-2024-38475, CVE-2024-40763, CVE-2024-45318, CVE-2024-45319, CVE-2024-53702, CVE-2024-53703","is_workaround_available":false,"summary":"\r\n\r\n
1) Path traversal vulnerability – attributed to publicly known Apache HTTP Server vulnerability (CVE-2024-38475)
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to file system locations that are permitted to be served by the server.\r\n
CVSS Score: 9.8
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
\r\nCWE-35: Path traversal vulnerability\r\n\r\n
\r\n\r\n
2) CVE-2024-40763 - SonicWALL SMA100 Heap-based buffer overflow vulnerability
Heap-based buffer overflow vulnerability in the SonicWall SMA100 SSLVPN due to the use of strcpy. This allows remote authenticated attackers to cause Heap-based buffer overflow and potentially lead to code execution.\r\n
CVSS Score: 7.5
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
\r\nCWE-122: Heap-based Buffer Overflow\r\n\r\n
3) CVE-2024-45318 - Stack-based buffer overflow vulnerability
A vulnerability in the SonicWall SMA100 SSLVPN web management interface allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.
CVSS Score: 8.1
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
\r\nCWE-121: Stack-based Buffer Overflow\r\n\r\n
\r\n\r\n
4) CVE-2024-45319 - Certificate-based authentication bypass
A vulnerability in the SonicWall SMA100 SSLVPN allows a remote authenticated attacker can circumvent the certificate requirement during authentication.\r\n
CVSS Score: 6.3
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
\r\nCWE-798: Use of Hard-coded Credentials\r\n\r\n
5) CVE-2024-53702 - Insecure randomness
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicWall SMA100 SSLVPN backup code generator that, in certain cases, can be predicted by an attacker, potentially exposing the generated secret.
CVSS Score: 5.3
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
\r\nCWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\r\n\r\n
6) CVE-2024-53703 - Stack-based buffer overflow vulnerability
A vulnerability in the SonicWall SMA100 SSLVPN mod_httprp library loaded by the Apache web server allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.
CVSS Score: 8.1
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
\r\nCWE-121: Stack-based Buffer Overflow\r\n\r\n
SonicWall SSL VPN SMA1000 series products are not affected by these vulnerabilities.
SonicWall strongly advises users of the SMA 100 series products (SMA 200, 210, 400, 410, and 500v) to upgrade to the mentioned fixed release version to address these vulnerabilities.
","affected_products":"| \r\n Affected\r\n Product(s) \r\n | \r\n \r\n Affected\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.1.13-72sv and earlier versions. | \r\n
SonicWall SSL VPN SMA1000 series products are not affected by these vulnerabilities.
","vuln_status":"Applicable","patterns":[{"pattern":"^(?:[0-9]\\.\\d+\\.\\d+\\.\\d+-\\d+sv|10\\.[0-1]\\.\\d+\\.\\d+-\\d+sv|10\\.2\\.0\\.\\d+-\\d+sv|10\\.2\\.1\\.(?:[0-9]|1[0-2])-\\d+sv|10\\.2\\.1\\.13-(?:[0-9]|[1-6]\\d|7[0-1])sv|10\\.2\\.1\\.13-72sv)$","name":"Secure Mobile Access (SMA) 100 Series","id":4}],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2025-0011","title":"SonicWall SMA100 SSL-VPN Affected By Multiple Vulnerabilities","published_when":"2025-05-07T12:53:25Z","last_updated_when":"2025-05-19T12:36:10Z","impact":"high","cvss":"8.8","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-552, CWE-22, CWE-78","cve":"CVE-2025-32819, CVE-2025-32820, CVE-2025-32821","is_workaround_available":false,"summary":"\r\n\r\n
1) CVE-2025-32819 - Post-Authentication SSLVPN user arbitrary file delete vulnerability
A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.\r\n
CVSS Score: 8.8
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
\r\nCWE-552: Files or Directories Accessible to External Parties\r\n\r\n
\r\n\r\n
2) CVE-2025-32820 - Post-Authentication SSLVPN user Path Traversal vulnerability
A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make any directory on the SMA appliance writable.\r\n
CVSS Score: 8.3
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
\r\nCWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\r\n\r\n
3) CVE-2025-32821 - Post-Authentication SSLVPN admin remote command injection vulnerability
A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell command arguments to upload a file on the appliance.
CVSS Score: 6.7
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
\r\nCWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\r\n\r\n
\r\n\r\n
\r\n\r\nSonicWall SSL VPN SMA1000 series products are not affected by these vulnerabilities.
SonicWall strongly advises users of the SMA 100 series products (SMA 200, 210, 400, 410, and 500v) to upgrade to the mentioned fixed release version to address these vulnerabilities.
","affected_products":"| \r\n Affected\r\n Product(s) \r\n | \r\n \r\n Affected\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.1.14-75sv and earlier versions. | \r\n
SonicWall SSL VPN SMA1000 series products are not affected by these vulnerabilities.
","vuln_status":"Applicable","patterns":[{"pattern":"^(?:[0-9]\\.\\d+\\.\\d+\\.\\d+-\\d+sv|10\\.[0-1]\\.\\d+\\.\\d+-\\d+sv|10\\.2\\.0\\.\\d+-\\d+sv|10\\.2\\.1\\.(?:[0-9]|1[0-3])-\\d+sv|10\\.2\\.1\\.14-(?:[0-9]|[1-6]\\d|7[0-4])sv|10\\.2\\.1\\.14-75sv)$","name":"Secure Mobile Access (SMA) 100 Series","id":4}],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2025-0012","title":"SonicWall SMA100 SSL-VPN Affected By Multiple Vulnerabilities","published_when":"2025-07-23T15:46:30Z","last_updated_when":"2025-07-23T15:46:30Z","impact":"high","cvss":"7.3","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cvss_version":3.0,"cwe":"CWE-121, CWE-122, CWE-79","cve":"CVE-2025-40596, CVE-2025-40597, CVE-2025-40598","is_workaround_available":false,"summary":"\r\n\r\n
1) CVE-2025-40596 - Pre-Authentication Stack-Based Buffer Overflow Vulnerability
A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution.\r\n
CVSS Score: 7.3
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
\r\nCWE-121: Stack-based Buffer Overflow\r\n\r\n
\r\n\r\n
2) CVE-2025-40597 - Pre-Authentication Heap-Based Buffer Overflow Vulnerability
A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution.\r\n
CVSS Score: 7.3
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
\r\nCWE-122: Heap-based Buffer Overflow\r\n\r\n
3) CVE-2025-40598 - Reflected Cross-Site Scripting (XSS) Vulnerability
A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code.
CVSS Score: 6.3
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
\r\nCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\r\n\r\n
\r\n\r\n
\r\n\r\nSonicWall strongly advises users of the SMA100 series products (SMA 210, 410, and 500v) to upgrade to the mentioned fixed release version to address these vulnerabilities.
There is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild.
| \r\n Affected\r\n Product(s) \r\n | \r\n \r\n Affected\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.1.15-81sv and earlier versions. | \r\n
SonicWall SSL VPN SMA1000 series products and SSL-VPN running on SonicWall firewalls are not affected by these vulnerabilities.
","vuln_status":"Applicable","patterns":[{"pattern":"^(?:[0-9]\\.\\d+\\.\\d+\\.\\d+-\\d+sv|10\\.[0-1]\\.\\d+\\.\\d+-\\d+sv|10\\.2\\.0\\.\\d+-\\d+sv|10\\.2\\.1\\.(?:[0-9]|1[0-4])-\\d+sv|10\\.2\\.1\\.15-(?:[0-9]|[1-7]\\d|80)sv|10\\.2\\.1\\.15-81sv)$","name":"Secure Mobile Access (SMA) 100 Series","id":4}],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2025-0019","title":"SonicWall SMA1000 appliance local privilege escalation vulnerability","published_when":"2025-12-17T13:51:12Z","last_updated_when":"2025-12-18T11:34:30Z","impact":"medium","cvss":"6.6","cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-862, CWE-250","cve":"CVE-2025-40602","is_workaround_available":true,"summary":"A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).
\r\n\r\nPlease note that SonicWall Firewall products are not affected by this vulnerability.
","affected_products":"Affected Product | Affected Version(s) |
SMA1000 | 12.4.3-03093 (platform-hotfix) and earlier versions. 12.5.0-02002 (platform-hotfix) and earlier versions. |
Note: This vulnerability does not affect SSL-VPN running on SonicWall firewalls.
\r\n\r\nThe latest platform-hotfix is available for download on mysonicwall.com","vuln_status":"Applicable","patterns":[{"pattern":"^(?:(?:12\\.[0-3]\\.\\d{1,1}-\\d{1,5}|12\\.4\\.[0-2]-\\d{5}|12\\.4\\.3-(?:0[0-2]\\d{3}|030[0-8]\\d|0309[0-3]))|(?:12\\.[0-3]\\.\\d{1,1}-\\d{1,5}|12\\.5\\.0-(?:0[0-1]\\d{3}|0200[0-2])))$","name":"Secure Mobile Access (SMA) 1000 Series","id":5}],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 1000 Series","id":5}]},{"advisory_id":"SNWLID-2022-0015","title":"SonicWall SMA1000 CVE-2021-33909 and CVE-2022-0847","published_when":"2022-08-09T19:24:37Z","last_updated_when":"2022-08-09T19:24:37Z","impact":"high","cvss":"7.8","cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":null,"cve":"CVE-2021-33909, CVE-2022-0847","is_workaround_available":false,"summary":"This advisory is intended to address Linux Kernel vulnerability CVE-2021-33909 and CVE-2022-0847 in the SonicWall SMA1000 platform.
SonicWall has performed a comprehensive analysis of the SMA1000 platform that resulted in no observable attack vectors for CVE-2021-33909 and CVE-2022-0847. To remove any potential risk from customer environments SonicWall is releasing firmware for the SMA1000 Platform out of an abundance of caution, addressing these vulnerabilities.
CVE-2021-33909: fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.
CVE-2022-0847: A flaw was found in the way the \"flags\" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read-only files and as such escalate their privileges on the system.
SonicWall SMA1000 Linux kernel has been upgraded to fix version 5.4.187 in the SMA1000 firmware12.4.2-05082 and higher versions.
","affected_products":"SonicWall SMA1000 12.4.2-02044 and earlier versions","vuln_status":"Applicable","patterns":[{"pattern":"^(?:(?:[0-9]|1[0-1])\\.\\d+\\.\\d+-\\d+|12\\.[0-3]\\.\\d+-\\d+|12\\.4\\.[0-1]-\\d+|12\\.4\\.2-(?:0[0-1]\\d{3}|020[0-3]\\d|0204[0-3])|12\\.4\\.2-02044)$","name":"Secure Mobile Access (SMA) 1000 Series","id":5}],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 1000 Series","id":5}]},{"advisory_id":"SNWLID-2025-0010","title":"SonicWall SMA1000 Encoded URL SSRF Vulnerability","published_when":"2025-05-14T15:39:25Z","last_updated_when":"2025-05-14T15:39:25Z","impact":"high","cvss":"7.2","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_version":3.0,"cwe":"CWE-918","cve":"CVE-2025-40595","is_workaround_available":false,"summary":"A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. By using an encoded URL, a remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
IMPORTANT: SonicWall PSIRT strongly advises users of the SMA1000 product to upgrade to the latest hotfix release version to address the vulnerability.
Please note that SonicWall Firewall and SMA 100 series products are not affected by this vulnerability.
","affected_products":"Affected Product | Affected Version(s) |
SMA1000 | 12.4.3-02925 (platform-hotfix) and earlier versions |
A vulnerability in the SonicWall SMA1000 HTTP Extraweb server allows an unauthenticated remote attacker to cause HTTP server crash which leads to Denial of Service. This vulnerability affected SMA1000 Version 12.1.0-06411 and earlier.
","affected_products":"SonicWall SMA1000 12.1.0-06411 and earlier","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 1000 Series","id":5}]},{"advisory_id":"SNWLID-2026-0003","title":"SonicWall SMA1000 Series Appliances Affected By Multiple Vulnerabilities","published_when":"2026-04-08T11:47:22Z","last_updated_when":"2026-04-08T11:47:22Z","impact":"high","cvss":"7.2","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-89, CWE-204, CWE-176","cve":"CVE-2026-4112, CVE-2026-4113, CVE-2026-4114, CVE-2026-4116","is_workaround_available":false,"summary":"\r\n\r\n
1) CVE-2026-4112 - Privilege Escalation via SQL Injection
Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote authenticated attacker with read-only administrator privileges to escalate privileges to primary administrator.\r\n
CVSS Score: 7.2
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
\r\nCWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\r\n\r\n
\r\n\r\n
2) CVE-2026-4113 - Authentication Response Discrepancy Allows User Credential Enumeration
An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials.\r\n
CVSS Score: 5.3
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
\r\nCWE-204: Observable Response Discrepancy\r\n
\r\n\r\n
3) CVE-2026-4114 - Unicode Possible AMC TOTP Bypass vulnerability
Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP authentication.\r\n
CVSS Score: 6.6
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
\r\nCWE-176: Improper Handling of Unicode Encoding\r\n\r\n
4) CVE-2026-4116 - Unicode Possible Workplace/Connect Tunnel TOTP Bypass vulnerability
Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication.\r\n
CVSS Score: 6.0
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
\r\nCWE-176: Improper Handling of Unicode Encoding\r\n\r\n
\r\n\r\n
\r\n\r\nSonicWall strongly advises users of the SMA1000 series appliances to upgrade to the mentioned fixed release version to address these vulnerabilities.
There is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild. Please note that SSL-VPN running on SonicWall Firewall products are not affected by this vulnerability.
Affected Product | Affected Version(s) |
SMA1000 | 12.4.3-03245 (platform-hotfix) and earlier versions. 12.5.0-02283 (platform-hotfix) and earlier versions. |
Note: This vulnerability does not affect SSL-VPN running on SonicWall firewalls.
\r\n\r\nThe latest platform-hotfix is available for download on mysonicwall.com","vuln_status":"Applicable","patterns":[{"pattern":"^(?:(?:12\\.[0-3]\\.\\d{1}-\\d{1,5}|12\\.4\\.[0-2]-\\d{5}|12\\.4\\.3-(?:0[0-2]\\d{3}|03[0-1]\\d{2}|032[0-3]\\d|0324[0-5]))|(?:12\\.[0-3]\\.\\d{1}-\\d{1,5}|12\\.5\\.0-(?:0[0-1]\\d{3}|02[0-1]\\d{2}|022[0-7]\\d|0228[0-3])))$","name":"Secure Mobile Access (SMA) 1000 Series","id":5}],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 1000 Series","id":5}]},{"advisory_id":"SNWLID-2026-0008","title":"SonicWall SMA1000 Series Appliances Affected By Multiple Vulnerabilities","published_when":"2026-07-14T14:43:22Z","last_updated_when":"2026-07-14T14:43:22Z","impact":"critical","cvss":"10.0","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-918, CWE-94","cve":"CVE-2026-15409, CVE-2026-15410","is_workaround_available":false,"summary":"\r\n\r\n
1) CVE-2026-15409 - A Server-side request forgery (SSRF)
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.\r\n
CVSS Score: 10.0
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
\r\nCWE-918: Server-Side Request Forgery (SSRF)\r\n\r\n
\r\n\r\n
2) CVE-2026-15410 - Post-authentication improper control of generation of code ('Code Injection')
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.\r\n
CVSS Score: 7.2
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
\t\r\nCWE-94: Improper Control of Generation of Code ('Code Injection')\r\n
\r\n\r\n
\r\n\r\nIMPORTANT: SonicWall PSIRT has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory. Customers are strongly urged to upgrade to the hotfix release as soon as possible to remediate these vulnerabilities.
","affected_products":"Affected Product | Affected Version(s) |
SMA1000 Models - 6210, 7210, 8200v | 12.4.3-03245, 12.4.3-03387 and 12.4.3-03434 (platform-hotfix) 12.5.0-02283, 12.5.0-02624 and 12.5.0-02800 (platform-hotfix) |
Note: These vulnerabilities do not affect SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line.
\r\n\r\nThe latest platform-hotfix is available for download on mysonicwall.com","vuln_status":"Applicable","patterns":[{"pattern":"^(?:12\\.4\\.3-03245|12\\.4\\.3-03387|12\\.4\\.3-03434|12\\.5\\.0-02283|12\\.5\\.0-02624|12\\.5\\.0-02800)$","name":"Secure Mobile Access (SMA) 1000 Series","id":5}],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 1000 Series","id":5}]},{"advisory_id":"SNWLID-2026-0016","title":"SonicWall SMA1000 Series Appliances Affected By Multiple Vulnerabilities","published_when":"2026-09-01T05:43:57Z","last_updated_when":"2026-09-01T05:43:57Z","impact":"critical","cvss":"10.0","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-918, CWE-441, CWE-78","cve":"CVE-2026-83548, CVE-2026-83549","is_workaround_available":false,"summary":"\r\n\r\n
1) CVE-2026-83548 - Pre-authentication SSRF via unintended forward-proxy
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations..\r\n
CVSS Score: 10.0
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
\r\nCWE-918: Server-Side Request Forgery (SSRF)
\r\nCWE-441: Unintended Proxy or Intermediary ('Confused Deputy')\r\n\r\n
\r\n\r\n
2) CVE-2026-83549 - Post-authentication Remote Code Execution (RCE) Vulnerability
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.\r\n
CVSS Score: 7.8
\r\nCVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
\t\r\nCWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\r\n
\r\n\r\n
\r\n\r\nIMPORTANT: SonicWall PSIRT has investigated a case indicating the active exploitation of the vulnerabilities described in this advisory. Customers are strongly urged to upgrade to the hotfix release as soon as possible to remediate this vulnerability.
","affected_products":"Affected Product | Affected Version(s) |
SMA1000 Models - 6210, 7210, 8200v | 12.4.3-03453 (platform-hotfix) and older versions. 12.5.0-02835 (platform-hotfix) and older versions. |
Note: These vulnerabilities do not affect SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line.
\r\n\r\nThe latest platform-hotfix is available for download on mysonicwall.com","vuln_status":"Applicable","patterns":[{"pattern":"^(?:12\\.4\\.[0-2]-\\d{1,5}|12\\.4\\.3-(?=\\d{1,5}$)0*(?:\\d{1,3}|[12]\\d{3}|3[0-3]\\d{2}|34[0-4]\\d|345[0-3])|12\\.5\\.0-(?=\\d{1,5}$)0*(?:\\d{1,3}|1\\d{3}|2[0-7]\\d{2}|28[0-2]\\d|283[0-5]))$","name":"Secure Mobile Access (SMA) 1000 Series","id":5}],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 1000 Series","id":5}]},{"advisory_id":"SNWLID-2026-0017","title":"SonicWall SMA1000 Series Appliances Affected By Multiple Vulnerabilities","published_when":"2026-10-06T09:44:00Z","last_updated_when":"2026-10-06T09:44:00Z","impact":"critical","cvss":"10.0","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-918, CWE-441, CWE-78, CWE-22, CWE-79","cve":"CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, CVE-2026-102258","is_workaround_available":false,"summary":"\r\n\r\n
1) CVE-2026-102255 - Pre-authentication SSRF via unintended forward-proxy
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.
CVSS Score: 10.0
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
\r\nCWE-918: Server-Side Request Forgery (SSRF)
\r\nCWE-441: Unintended Proxy or Intermediary ('Confused Deputy')\r\n\r\n
\r\n\r\n
2) CVE-2026-102256 - Post-authentication Remote Code Execution (RCE) Vulnerability
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.\r\n
CVSS Score: 7.8
\r\nCVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
\t\r\nCWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\r\n
3) CVE-2026-102257 - Post-authentication Zip Slip Vulnerability
A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution.
CVSS Score: 7.2
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
\r\nCWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\r\n
\r\n\r\n
4) CVE-2026-102258 - Post-authentication Stored Cross-Site Scripting (XSS) Vulnerability
Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC).\r\n
CVSS Score: 5.5
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
\t\r\nCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\r\n
\r\n\r\n
\r\n\r\nSonicWall strongly advises users of the SMA1000 series appliances to upgrade to the mentioned fixed release version to address these vulnerabilities.
There is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild. Please note that SSL-VPN running on SonicWall Firewall products are not affected by this vulnerability.
Affected Product | Affected Version(s) |
SMA1000 Models - 6210, 7210, 8200v | 12.4.3-03526 (platform-hotfix) and older versions. 12.5.0-02952 (platform-hotfix) and older versions. |
Note: These vulnerabilities do not affect SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line.
\r\n\r\nThe latest platform-hotfix is available for download on mysonicwall.com","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 1000 Series","id":5}]},{"advisory_id":"SNWLID-2025-0008","title":"SonicWall SMA1000 SSRF Vulnerability","published_when":"2025-04-30T14:26:04Z","last_updated_when":"2025-04-30T14:26:04Z","impact":"high","cvss":"7.2","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_version":3.0,"cwe":"CWE-918","cve":"CVE-2025-2170","is_workaround_available":false,"summary":"A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface, which in specific conditions could potentially enable a remote unauthenticated attacker to cause the appliance to make requests to an unintended location.
IMPORTANT: SonicWall PSIRT strongly advises users of the SMA1000 product to upgrade to the latest hotfix release version to address the vulnerability.
Please note that SonicWall Firewall and SMA 100 series products are not affected by this vulnerability.
","affected_products":"Affected Product | Affected Version(s) |
SMA1000 | 12.4.3-02907 (platform-hotfix) and earlier versions |
sonicwall soho 4.0.0
sonicwall soho 5.0.0
sonicwall soho 5.1.5.0
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"SonicOS Gen5 Platform - TZ/NSa","id":1}]},{"advisory_id":"SNWLID-2000-0001","title":"SonicWALL SOHO username denial of service","published_when":"2001-01-09T05:00:00Z","last_updated_when":"2017-10-10T01:29:00Z","impact":"Medium","cvss":"5.0","cvss_vector":"(AV:N/AC:L/Au:N/C:N/I:N/A:P)","cvss_version":2.0,"cwe":"","cve":"CVE-2000-1097","is_workaround_available":false,"summary":"The web server for the SonicWALL SOHO firewall allows remote attackers to cause a denial of service via a long username in the authentication page.","affected_products":"sonicwall soho firewall 4.0.0
sonicwall soho firewall 5.0.0
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"SonicOS Gen5 Platform - TZ/NSa","id":1}]},{"advisory_id":"SNWLID-2005-0001","title":"SonicWALL SOHO Web Interface Multiple Remote Input Validation Vulnerabilities","published_when":"2005-05-02T04:00:00Z","last_updated_when":"2017-07-11T01:32:00Z","impact":"Medium","cvss":"4.3","cvss_vector":"(AV:N/AC:M/Au:N/C:N/I:P/A:N)","cvss_version":2.0,"cwe":"","cve":"CVE-2005-1006","is_workaround_available":false,"summary":"Multiple cross-site scripting (XSS) vulnerabilities in SonicWALL SOHO 5.1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the URL or (2) the user login name, which is not filtered when the administrator views the log file.","affected_products":"sonicwall soho 5.1.7.0
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"SonicOS Gen5 Platform - TZ/NSa","id":1}]},{"advisory_id":"SNWLID-2002-0002","title":"SonicWALL SOHO3 blocked URL log file script injection","published_when":"2002-12-31T05:00:00Z","last_updated_when":"2008-09-05T20:32:00Z","impact":"Medium","cvss":"4.3","cvss_vector":"(AV:N/AC:M/Au:N/C:N/I:P/A:N)","cvss_version":2.0,"cwe":"CWE-79","cve":"CVE-2002-2341","is_workaround_available":false,"summary":"Cross-site scripting (XSS) vulnerability in content blocking in SonicWALL SOHO3 6.3.0.0 allows remote attackers to inject arbitrary web script or HTML via a blocked URL.","affected_products":"sonicwall soho3 6.3.0.0
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"SonicOS Gen6 Platform - TZ/NSa/SM/NSv","id":2}]},{"advisory_id":"SNWLID-2007-0001","title":"SonicWALL SSL VPN Client Remote ActiveX Multiple Vulnerabilities","published_when":"2007-11-05T18:46:00Z","last_updated_when":"2017-09-29T01:29:00Z","impact":"High","cvss":"9.3","cvss_vector":"(AV:N/AC:M/Au:N/C:C/I:C/A:C)","cvss_version":2.0,"cwe":"CWE-119","cve":"CVE-2007-5603","is_workaround_available":false,"summary":"Stack-based buffer overflow in the SonicWall SSL-VPN NetExtender NELaunchCtrl ActiveX control before 2.1.0.51, and 2.5.x before 2.5.0.56, allows remote attackers to execute arbitrary code via a long string in the second argument to the AddRouteEntry method.","affected_products":"SonicWall SSL-VPN 200
SonicWall SSL-VPN 2000
SonicWall SSL-VPN 4000
2.1 and earlier on SSL-VPN 200
2.5 and earlier on SSL-VPN 2000/4000
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2007-0002","title":"SonicWALL SSL VPN Client Remote ActiveX Multiple Vulnerabilities","published_when":"2007-11-05T18:46:00Z","last_updated_when":"2017-07-29T01:33:00Z","impact":"High","cvss":"9.3","cvss_vector":"(AV:N/AC:M/Au:N/C:C/I:C/A:C)","cvss_version":2.0,"cwe":"CWE-119","cve":"CVE-2007-5814","is_workaround_available":false,"summary":"Multiple buffer overflows in the SonicWall SSL-VPN NetExtender NELaunchCtrl ActiveX control before 2.1.0.51, and 2.5.x before 2.5.0.56, allow remote attackers to execute arbitrary code via a long (1) serverAddress, (2) sessionId, (3) clientIPLower, (4) clientIPHigher, (5) userName, (6) domainName, or (7) dnsSuffix Unicode property value. NOTE: the AddRouteEntry vector is covered by CVE-2007-5603.","affected_products":"SonicWall SSL-VPN 200
SonicWall SSL-VPN 2000
SonicWall SSL-VPN 4000
2.1 and earlier on SSL-VPN 200
2.5 and earlier on SSL-VPN 2000/4000
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2007-0003","title":"SonicWALL SSL VPN Client Remote ActiveX Multiple Vulnerabilities","published_when":"2007-11-05T18:46:00Z","last_updated_when":"2017-07-29T01:33:00Z","impact":"High","cvss":"10.0","cvss_vector":"(AV:N/AC:L/Au:N/C:C/I:C/A:C)","cvss_version":2.0,"cwe":"CWE-22","cve":"CVE-2007-5815","is_workaround_available":false,"summary":"Absolute path traversal vulnerability in the WebCacheCleaner ActiveX control 1.3.0.3 in SonicWall SSL-VPN 200 before 2.1, and SSL-VPN 2000/4000 before 2.5, allows remote attackers to delete arbitrary files via a full pathname in the argument to the FileDelete method.","affected_products":"SonicWall SSL-VPN 200
SonicWall SSL-VPN 2000
SonicWall SSL-VPN 4000
2.1 and earlier on SSL-VPN 200
2.5 and earlier on SSL-VPN 2000/4000
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2010-0001","title":"SonicWALL SSL-VPN E-Class ActiveX Control Multiple Buffer Overflow Vulnerabilities","published_when":"2010-11-03T13:37:00Z","last_updated_when":"2017-08-17T01:32:00Z","impact":"High","cvss":"9.3","cvss_vector":"(AV:N/AC:M/Au:N/C:C/I:C/A:C)","cvss_version":2.0,"cwe":"CWE-119","cve":"CVE-2010-2583","is_workaround_available":false,"summary":"Stack-based buffer overflow in SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX control (Aventail.EPInstaller) before 10.5.2 and 10.0.5 hotfix 3 allows remote attackers to execute arbitrary code via long (1) CabURL and (2) Location arguments to the Install3rdPartyComponent method.","affected_products":"SonicWall EX7000
SonicWall EX6000
SonicWall EX2500
SonicWall EX1600
SonicWall EX1500
SonicWall EX750
10.5.1, 10.0.5 without hotfix \"clt-hotfix-10_0_5-003\"\"
\"","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 1000 Series","id":5}]},{"advisory_id":"SNWLID-2022-0008","title":"SonicWall SSL-VPN NetExtender Windows Client Buffer Overflow Vulnerability","published_when":"2022-05-06T11:44:20Z","last_updated_when":"2022-05-06T11:44:20Z","impact":"medium","cvss":"4.8","cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","cvss_version":3.0,"cwe":"CWE-121","cve":"CVE-2022-22281","is_workaround_available":false,"summary":"A buffer overflow vulnerability in the SonicWall SSL-VPN NetExtender Windows Client (32 and 64 bit) in 10.2.322 and earlier versions, allows an attacker to potentially execute arbitrary code in the host windows operating system.","affected_products":"NetExtender Windows (32 and 64 bit) 10.2.322 and earlier versions.
Note: NetExtender Linux client versions are not affected by this vulnerability.
\r\n\r\n
1) CVE-2023-44221 - Post Authentication OS Command Injection Vulnerability
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.\r\n
CVSS Score: 7.2
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
\r\nCWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\r\n\r\n
IMPACT:\r\n\r\nAs outlined in SNWLID-2023-0018, successfully leveraging CVE-2023-44221 against impacted SMA 100 devices can result in the post-authenticated remote attacker with administrative privilege being able to inject arbitrary commands which can potentially lead to OS command execution on the appliance.
\r\n\r\n
2) CVE-2023-5970 - Post Authentication External User MFA Bypass Vulnerability
Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user, resulting in an MFA bypass.
CVSS Score: 6.3
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
\r\nCWE-287: Improper Authentication\r\n\r\n
SonicWall strongly advises SMA 100 series product users, which include SMA 200, 210, 400, 410, and 500v products to upgrade to the mentioned fixed release version.
| \r\n Impacted\r\n Product(s) \r\n | \r\n \r\n Impacted\r\n Versions | \r\n
| \r\n SMA\r\n 100 Series | \r\n \r\n 10.2.1.9-57sv and earlier versions. | \r\n
\r\n\r\n
1) CVE-2024-45315 - SonicWALL SMA1000 Connect Tunnel Windows Client Link Following Denial-of-Service Vulnerability
The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client) allows users with standard privileges to create arbitrary folders and files, potentially leading to local Denial of Service (DoS) attack.\r\n
CVSS Score: 6.1
\r\nCVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
\r\nCWE-59: Improper Link Resolution Before File Access ('Link Following')\r\n\r\n
\r\n\r\n
2) CVE-2024-45316 - SonicWALL SMA1000 Connect Tunnel Windows Client Link Following Local Privilege Escalation Vulnerability
The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client) allows users with standard privileges to delete arbitrary folders and files, potentially leading to local privilege escalation attack.\r\n
CVSS Score: 7.8
\r\nCVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
\r\nCWE-59: Improper Link Resolution Before File Access ('Link Following')\r\n\r\n
3) CVE-2024-45317 - Unauthenticated SMA1000 12.4.x Server-Side Request Forgery (SSRF) Vulnerability
Unauthenticated SMA1000 12.4.x Server-Side Request Forgery (SSRF) Vulnerability allows a remote unauthenticated attacker to cause the server-side application to make requests to an unintended IP address.
CVSS Score: 7.2
\r\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
\r\nCWE-918: Server-Side Request Forgery (SSRF)\r\n\r\n
There is no evidence that these vulnerabilities are being exploited in the wild and SonicWall SSL VPN SMA 100 series products are not affected by these vulnerabilities.
SonicWall strongly advises SSLVPN SMA 1000 series product and Connect Tunnel client users to upgrade to the mentioned fixed-release version.
","affected_products":"SMA1000 Connect Tunnel Windows (32 and 64-bit) Client 12.4.3.271 and earlier versions,
SMA1000 Appliance firmware 12.4.3-02676 and earlier versions.
\r\n\r\nNote: This vulnerability does not affect Connect Tunnel Linux and Mac client versions.","vuln_status":"Applicable","patterns":[{"pattern":"^(?:(?:[0-9]|1[0-1])\\.\\d+\\.\\d+\\.\\d+|12\\.[0-3]\\.\\d+\\.\\d+|12\\.4\\.[0-2]\\.\\d+|12\\.4\\.3\\.(?:[0-9]|[1-9]\\d|1\\d{2}|2[0-6]\\d|270)|12\\.4\\.3\\.271)$","name":"Connect Tunnel","id":8},{"pattern":"^(?:(?:[0-9]|1[0-1])\\.\\d+\\.\\d+-\\d+|12\\.[0-3]\\.\\d+-\\d+|12\\.4\\.[0-2]-\\d+|12\\.4\\.3-(?:0[0-1]\\d{3}|02[0-5]\\d{2}|026[0-6]\\d|0267[0-5])|12\\.4\\.3-02676)$","name":"Secure Mobile Access (SMA) 1000 Series","id":5}],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 1000 Series","id":5},{"name":"Connect Tunnel","id":8}]},{"advisory_id":"SNWLID-2020-0022","title":"SonicWall SSLVPN SMA100 authenticated command injection vulnerability","published_when":"2021-01-09T00:18:14Z","last_updated_when":"2021-01-09T00:18:14Z","impact":"high","cvss":"7.2","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-78","cve":"CVE-2020-5146","is_workaround_available":false,"summary":"A vulnerability in the SonicWall SMA100 appliance allows an authenticated management-user to perform OS command injection using HTTP POST parameters. This vulnerability affected SMA100 build version 10.2.0.2-20sv and earlier.","affected_products":"SMA100 build version 10.2.0.2-20sv and earlier.
SonicWall SMA1000 appliances are not affected by this vulnerability.
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2022-0009","title":"SonicWall SSLVPN SMA1000 series affected by multiple vulnerabilities","published_when":"2022-05-12T17:59:32Z","last_updated_when":"2022-08-03T17:59:32Z","impact":"high","cvss":"8.2","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss_version":3.0,"cwe":"CWE-284, CWE-321, CWE-601","cve":"CVE-2022-22282, CVE-2022-1701, CVE-2022-1702","is_workaround_available":false,"summary":"| \r\n Impacted Platforms: SMA 1000 Series SMA\r\n 6200, 6210, 7200, 7210, 8000v (ESX, KVM, Hyper-V,\r\n AWS, Azure) \r\n | \r\n |||
| \r\n Summary | \r\n \r\n CVSS Score | \r\n \r\n Impacted Firmware | \r\n \r\n CVE ID | \r\n
| \r\n 1. Unauthenticated Access\r\n Control Bypass | \r\n \r\n 8.2 | \r\n \r\n 12.4.0 | \r\n \r\n \r\n | \r\n
| \r\n 2 Use of hard-coded\r\n cryptographic key. | \r\n \r\n 5.7 (Medium) | \r\n \r\n 12.4.0 12.4.1 | \r\n \r\n \r\n | \r\n
| \r\n 3. URL redirection to an\r\n untrusted site (open redirection) \r\n | \r\n \r\n 6.1 | \r\n \r\n 12.4.0 12.4.1 | \r\n \r\n \r\n | \r\n
Note: Above vulnerabilities DO NOT impact the following products,
| \r\n Product | \r\n \r\n \r\n \r\n\r\n | \r\n
| \r\n SonicWall Switch | \r\n\r\n Affected Version | \r\n
| \r\n Models - SWS14-48FPOE, SWS14-48, SWS14-24FPOE, SWS14-24, SWS12-10FPOE, SWS12-8POE, SWS12-8 | \r\n \r\n 1.0.0.5-16 and earlier | \r\n
SonicWall Global Management System (GMS) 6.0 SP1, 5.X and Older
SonicWall Analyzer 6.0 SP1, 5.X and Older
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Global Management System (GMS)","id":19}]},{"advisory_id":"SNWLID-2018-0004","title":"Speculative Store Bypass (SSB) – also known as Variant 4","published_when":"2018-05-24T00:00:00Z","last_updated_when":"2018-06-04T20:00:00Z","impact":"medium","cvss":"4.3","cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","cvss_version":3.0,"cwe":"CWE-200","cve":"CVE-2018-3639","is_workaround_available":false,"summary":"Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.","affected_products":"SonicWall is investigating its product line and the\r\nfollowing products may be affected by Meltdown/Spectre and variants:
GMS
SMA
ES
WAF
CGMS
\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
Remaining product is still under investigation.
| \r\n \r\n \r\n SonicWall Product (Appliance/Cloud/Virtual/OnPrem) | \r\n \r\n \r\n \r\n Status | \r\n \r\n \r\n \r\n Description | \r\n
| \r\n \r\n Email Security - Hosted Email Security (HES) - On-Premise Email Security | \r\n \r\n \r\n Not Impacted\r\n \r\n | \r\n \r\n Spring framework is not used in the Email Security appliance. | \r\n
| \r\n NSM - NSM SaaS - NSM On-Premise \r\n | \r\n \r\n \r\n Not Impacted | \r\n NSM is not using the vulnerable Spring Framework components and is not impacted. | \r\n
| \r\n WAF \r\n | \r\n \r\n Not Impacted | \r\n Spring framework is not used in the WAF appliance. | \r\n
| \r\n \r\n Gen5 Firewalls (EOS) - TZ100/W - TZ200/W - TZ210/W - NSA 220/W - NSA 250M/250M-W - NSA 2400/MX/3500/4500/5500 - NSA E5500/6500/6500/8500/8510 | \r\n \r\n \r\n Not Impacted | \r\n \r\n Spring framework is not used in the Gen5 appliance. | \r\n
| \r\n \r\n Gen6 Firewalls - TZ300/W; TZ350/W - TZ400/W - TZ500/W - TZ600 - NSA 2600/2650/3600/3650/4600 /4650/5600/5650/6600/6650 - SM 9200/9400/9600/9800 - NSa 9250/9450/9650 - NSSP 12400/12800 - NSV 10/25/50/100/200/400/800/1600 (ESX, KVM, HYPER-V, AWS, Azure) | \r\n \r\n \r\n Not Impacted | \r\n \r\n Spring framework is not used in the Gen6 appliance. | \r\n
| \r\n \r\n Gen7 Firewalls - TZ270/W - TZ370/W - TZ470/W - TZ570/W - TZ670 - NSA 2700/3700/4700/5700/6700 - NSSP 10700/11700/13700/15700 - NSV 270/470/870 (ESX, KVM, HYPER-V, AWS, Azure) | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n Spring framework is not used in the Gen7 appliance. | \r\n
| \r\n \r\n SonicWall Switch - SWS 12-8/12-8POE - SWS 12-10FPOE - SWS 14-24/14-24FPOE - SWS 14-48/14-48FPOE | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n Spring framework is not used in the SonicWall Switch. | \r\n
| \r\n \r\n SMA 100 - SMA 200/210/400/410 - SMA 500v (ESX, KVM, Hyper-V, AWS, Azure) \r\n | \r\n \r\n \r\n Not Impacted\r\n \r\n | \r\n \r\n Spring framework is not used in the SMA100 appliance. | \r\n
| \r\n \r\n SMA 1000 - SMA 6200/7200/6210/7210 - SMA 8200v (ESX, KVM, Hyper-V, AWS, Azure) - SRA EX 7000 \r\n | \r\n \r\n \r\n Not Impacted | \r\n \r\n SMA1000 is not using the vulnerable Spring Framework components and is not impacted.. \r\n | \r\n
| \r\n \r\n MSW | \r\n \r\n \r\n Not Impacted | \r\n \r\n Spring framework is not used in the MSW. | \r\n
| \r\n \r\n Analyzer | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n Spring framework is not used in the Analyzer. | \r\n
| \r\n \r\n GMS | \r\n \r\n \r\n Not Impacted | \r\n \r\n Spring framework is not used in the GMS. | \r\n
| \r\n \r\n Capture Client & Capture Client Portal | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n Spring framework is not used in the Capture Client & Capture Client Portal. | \r\n
| \r\n \r\n CAS | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n Spring framework is not used in the CAS. | \r\n
| \r\n \r\n Access Points | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n Spring framework is not used in the SonicWall Access Points. | \r\n
| \r\n \r\n WNM | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n Spring framework is not used in the WNM. | \r\n
| \r\n \r\n Capture Security Appliance | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n Spring framework is not used in the appliance. | \r\n
| \r\n \r\n WXA - WXA 2000/4000 - Virtual: WXA 5000 - Software: WXA 500, WXA 6000 \r\n | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n Spring framework is not used in the appliance. \r\n \r\n | \r\n
| \r\n \r\n CSCMA\r\n \r\n | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n Spring framework is not used in the appliance. \r\n \r\n | \r\n
| \r\n \r\n EPRS\r\n \r\n | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n Spring framework is not used in the EPRS. \r\n \r\n | \r\n
| \r\n \r\n Cloud Edge\r\n \r\n | \r\n \r\n \r\n Not Impacted\r\n | \r\n \r\n Spring framework is not used in the Cloud Edge. \r\n \r\n | \r\n
| \r\n Analytics | \r\n \r\n Not Impacted | \r\n \r\n Spring framework is not used in the Analytics. | \r\n
SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and potentially enabling attackers to bypass MFA by exploiting the alternative account name.
IMPORTANT: For GEN7 and GEN8 Firewalls, we have incorporated the remediation steps described in the advisory (Comments section) into versions 7.2.0-7015 and 8.0.1-8017. These versions also include additional security enhancements. After upgrading the firewall to the specified version, the use of userPrincipalName in LDAP server configurations is once again supported.","affected_products":"Impacted Platforms | Impacted Versions |
Gen6 NSv - NSv10, NSv25, NSv50, NSv100, NSv200, NSv300, NSv400, NSv800, NSv1600 | 6.5.4.4-44v-21-2457 and older versions |
Gen6 Firewalls -SOHOW, TZ 300, TZ 300W, TZ 400, TZ 400W, TZ 500, TZ 500W, TZ 600, NSA 2650, NSA 3600, NSA 3650, NSA 4600, NSA 4650, NSA 5600, NSA 5650, NSA 6600, NSA 6650, SM 9200, SM 9250, SM 9400, SM 9450, SM 9600, SM 9650, TZ 300P, TZ 600P, SOHO 250, SOHO 250W, TZ 350, TZ 350W | 6.5.4.15-117n and older versions |
Gen7 Firewalls - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700 Gen7 NSv - NSV270, NSv470, NSv870 (ESX, KVM, HYPER-V, AWS, Azure) | 7.0.1-5161 and older versions 7.1.1-7058 and older versions 7.1.2-7019 and older versions |
TZ80 | Version 8.0.0-8035 |
SMA100 | 10.2.1.13-72sv and older versions |
Impacted Platforms | Impacted Version |
Gen7 - TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSv 270, NSv 470, NSv 870 |
|
sonicwall soho2 6.0.0
sonicwall tele2 6.0.0
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"SonicOS Gen6 Platform - TZ/NSa/SM/NSv","id":2}]},{"advisory_id":"SNWLID-2023-0015","title":"TunnelCrack Vulnerabilities","published_when":"2023-10-31T05:44:30Z","last_updated_when":"2023-10-31T05:44:30Z","impact":"not_defined","cvss":null,"cvss_vector":null,"cvss_version":3.0,"cwe":"CWE-829","cve":"CVE-2023-36671, CVE-2023-36672, CVE-2023-35838, CVE-2023-36673","is_workaround_available":true,"summary":"SonicWall PSIRT is aware of a research publication that outlines a series of attacks known as 'TunnelCrack' vulnerabilities.\r\n
\r\nThese attacks occur when VPN client traffic leaks outside of the secure VPN tunnel, typically happening when clients connect to untrusted networks, like rogue Wi-Fi access points. A Local Network attacker takes advantage of local network access features in various VPN clients from different vendors, allowing an attacker to access unencrypted traffic and an attacker intercepts traffic that's directed to a fake VPN gateway using DNS spoofing attacks.
However, these attacks do not provide the attacker with the ability to decrypt HTTPS or other encrypted traffic.
","affected_products":"9.0.0.10-28sv and earlier
10.2.0.7-34sv and earlier
10.2.1.0-17sv and earlier
","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 100 Series","id":4}]},{"advisory_id":"SNWLID-2022-0007","title":"Unauthenticated SQL Injection in SonicWall GMS and Analytics","published_when":"2022-07-21T19:30:12Z","last_updated_when":"2022-10-13T19:30:12Z","impact":"critical","cvss":"9.4","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cvss_version":3.0,"cwe":"CWE-89","cve":"CVE-2022-22280","is_workaround_available":true,"summary":"Improper Neutralization of Special Elements used in an SQL Command leading to Unauthenticated SQL Injection vulnerability, impacting SonicWall GMS and Analytics On-Prem.| \r\n Product \r\n | \r\n \r\n Affected\r\n Version \r\n | \r\n
| \r\n GMS | \r\n \r\n 9.3.1-SP2-Hotfix1 and earlier versions | \r\n
| \r\n Analytics | \r\n 2.5.0.3-2520 and earlier versions | \r\n
A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution in the firewall.
SonicWall PSIRT is not aware of active exploitation in the wild. No reports of a PoC have been made public and malicious use of this vulnerability has not been reported to SonicWall.
And SonicWall strongly urges organizations using impacted SonicWall firewalls listed below to follow the provided guidance.
NOTE: This vulnerability ONLY impacts the \"web management\" interface, the SonicOS SSLVPN interface is not impacted.
","affected_products":"The below SonicWall appliances are impacted by this vulnerability.
| \r\n Impacted Platforms | \r\n \r\n Impacted Version | \r\n
| \r\n TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700, NSsp 11700, NSsp 13700, NSv 270, NSv 470, NSv 870 | \r\n \r\n 7.0.1-5050 and older | \r\n
| \r\n NSsp 15700 | \r\n \r\n 7.0.1-R579 and older | \r\n
| \r\n NSv 10, NSv 25, NSv 50, NSv 100, NSv 200, NSv 300, | \r\n \r\n 6.5.4.4-44v-21-1452 and earlier | \r\n
The following firewall platforms are not impacted.
\r\n
| \r\n Firewall Generations | \r\n \r\n Platforms Not Impacted | \r\n
| \r\n SonicWall Gen5 Firewalls \r\n | \r\n \r\n SOHO, TZ100, TZ100W, TZ105, TZ105W, TZ200, TZ200W, TZ205, TZ205W, TZ210, TZ210W, TZ215, TZ215W, NSA220, NSA220W, NSA240, NSA2400, NSA4500, NSA5000, NSAE5500, NSAE6500, | \r\n
| \r\n SonicWall Gen6 Firewalls | \r\n \r\n SOHOW, SOHO 250, SOHO 250W, TZ300, TZ300P, | \r\n
| \r\n SonicWall Gen 6.5 Firewalls | \r\n \r\n NSa 2650, NSa3650, NSa4650, NSa5650, | \r\n
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
","affected_products":"mysonicwall.com","vuln_status":"Applicable","patterns":[],"vulnerable_products":[{"name":"MySonicWall","id":22}]}]