CRITICAL🇵🇱 Wersja polska

CVE-2024-22394

CVSS 9.8v3.1pub. 2024-02-08upd. 2024-11-21

An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific conditions could allow a remote attacker to bypass authentication.  This issue affects only firmware version SonicOS 7.1.1-7040.

🤖 AI Analysis
How it works

The vulnerability results from an error in the implementation of the authentication mechanism (CWE-287) in the SSL-VPN function of SonicOS. Under specific conditions, an attacker can send an appropriately crafted network request that will be processed bypassing user identity verification. The attack is possible remotely, over the network, without the need to possess any access credentials.

Impact

Successful exploitation of the vulnerability allows an unauthenticated attacker to gain unauthorized access to resources protected by SSL-VPN, which may lead to a violation of confidentiality, integrity, and system availability.

Mitigation & patch

Immediately update the firmware of SonicWall devices to a version higher than 7.1.1-7040, in accordance with the manufacturer's guidelines available at: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0003. Until the patch is applied, consider restricting access to the SSL-VPN interface only to trusted IP addresses.

Who is affected

SonicWall SonicOS version 7.1.1-7040 on devices: SonicWall NSA 2700, NSA 3700, NSA 4700, NSA 5700, and the SonicOS platform.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Sonicwall Nsa 2700

    HW
    Sonicwall
    all versions

  • Sonicwall Nsa 3700

    HW
    Sonicwall
    all versions

  • Sonicwall Nsa 4700

    HW
    Sonicwall
    all versions

  • Sonicwall Nsa 5700

    HW
    Sonicwall
    all versions

  • Sonicwall Nsa 6700

    HW
    Sonicwall
    all versions

  • Sonicwall Nssp 10700

    HW
    Sonicwall
    all versions

  • Sonicwall Nssp 11700

    HW
    Sonicwall
    all versions

  • Sonicwall Nssp 13700

    HW
    Sonicwall
    all versions

  • Sonicwall Nsv 270

    HW
    Sonicwall
    all versions

  • Sonicwall Nsv 470

    HW
    Sonicwall
    all versions

  • Sonicwall Nsv 870

    HW
    Sonicwall
    all versions

  • Sonicwall Sonicos

    OS
    Sonicwall
    7.1.1-7040

  • Sonicwall T2270

    HW
    Sonicwall
    all versions

  • Sonicwall Tz270w

    HW
    Sonicwall
    all versions

  • Sonicwall Tz370

    HW
    Sonicwall
    all versions

  • Sonicwall Tz370w

    HW
    Sonicwall
    all versions

  • Sonicwall Tz470

    HW
    Sonicwall
    all versions

  • Sonicwall Tz470w

    HW
    Sonicwall
    all versions

  • Sonicwall Tz570

    HW
    Sonicwall
    all versions

  • Sonicwall Tz570p

    HW
    Sonicwall
    all versions

  • Sonicwall Tz570w

    HW
    Sonicwall
    all versions

  • Sonicwall Tz670

    HW
    Sonicwall
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth BypassVPN
CWE
References

Related vulnerabilities

CVE-2024-53704CRITICAL9.8⚠ KEVPL ✓same product

SonicWall SonicOS SSLVPN — pominięcie uwierzytelnienia (Auth Bypass)

CVE-2024-40766CRITICAL9.8⚠ KEVPL ✓same product

Nieprawidłowa kontrola dostępu w SonicWall SonicOS — RCE i crash firewalla

CVE-2020-5135CRITICAL9.8⚠ KEVPL ✓same product

Buffer overflow w SonicOS umożliwiający DoS i zdalne wykonanie kodu

CVE-2025-40600CRITICAL9.8PL ✓same product

SonicOS SSL VPN: format string umożliwia zakłócenie usługi bez uwierzytelnienia

CVE-2024-3596CRITICAL9.0PL ✓same product

Atak przez fałszowanie odpowiedzi w protokole RADIUS (RFC 2865) via kolizja MD5