CVE-2024-40766

The flaw involves improper verification of access permissions in the SonicOS system management module. An unauthenticated remote attacker, without any user interaction, can gain access to protected device resources. Under certain conditions, exploiting this vulnerability can cause the firewall to completely stop functioning (crash), resulting in a break in network service availability.

An attacker can gain unauthorized access to firewall resources, and under specific conditions, cause its failure and thus interrupt network protection and service availability. The full impact includes violations of confidentiality, integrity, and availability (C:H/I:H/A:H).

Patches available from the vendor must be applied immediately in accordance with references published in SonicWall PSIRT (SNWLID-2024-0015). For Gen 7 devices, an update to a version newer than SonicOS 7.0.1-5035 is required. Until the patch is deployed, it is recommended to restrict or block access to the management interface from untrusted networks and the Internet.

SonicWall Firewall generation 5 (Gen 5) and generation 6 (Gen 6) in all SonicOS versions, as well as generation 7 (Gen 7) devices with SonicOS 7.0.1-5035 and earlier. Affected products include: SonicWall SonicOS, SonicWall SOHO, SonicWall NSSP 12400, SonicWall NSSP 12800.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.