- SonicWall sends an email to IT administrators warning them of a serious vulnerability in its firewalls
- The flaw is “susceptible to actual exploitation”, it said
- A Band-Aid is available, as well as a few remedial measures
SonicWall recently patched a serious vulnerability in its firewalls that is “susceptible to actual exploitation.” The company has since begun notifying IT administrators and urging them to apply the fix immediately and secure their endpoints.
Citing a couple of Reddit users who were contacted by SonicWall, Bleeping Computer said the vulnerability is an authentication bypass in SSL VPN and SSH management, tracked as CVE-2024-53704.
It has a severity score of 8.2 (high) and affects multiple generation six and generation seven firewalls, powered by SonicOS 6.5.4.15-117n and earlier and 7.0.1-5161 and earlier.
Three more mistakes
“We have identified a high (CVE Score 8.2) firewall vulnerability that is susceptible to actual exploitation for customers with SSL VPN or SSH management enabled, and which should be mitigated immediately by upgrading to the latest firmware, which will be published tomorrow, Jan. 7, 2025,” SonicWall apparently said in the email.
“The same firmware upgrade contains limitations for additional, less critical vulnerabilities.”
For those running Gen 6 or 6.5 hardware firewalls, SonicOS 6.5.5.1-6n or later is the firmware to update to, while Gen 6 / 6.5 NSv firewalls should look for SonicOS 6.5.4.v-21s-RC2457 or newer. Finally, TZ80 users need at least SonicOS 8.0.0-8037.
In the same patch, the company fixed three additional bugs (CVE-2024-40762, CVE-2024-53705, and CVE-2024-53706) that allow authentication bypass, remote code execution, and more.
Those unable to install the patch immediately should at least apply the restrictions SonicWall suggested in the security advisory, which include restricting access to trusted sources or disabling SSLVPN access from the Internet.
To minimize the potential impact of an SSH vulnerability, SonicWall suggests also limiting firewall administration to trusted sources and disabling firewall SSH management from the Internet.
Via Bleeping Computer
