SonicWall · SonicOS
CVE-2024-40766
SonicWall SonicOS Improper Access Control Vulnerability
Was es ist
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
CISA: SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.
Was zu tun ist
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Frist für US-Bundesbehörden: 30. September 2024
Weitere ausgenutzte Schwachstellen von SonicWall
| Hinzugefügt | Schwachstelle | Produkt | Schweregrad | Angriffswahrscheinlichkeit |
|---|---|---|---|---|
| 18.02.2025 | SSLVPN Improper Authentication | SonicOS | Hoch 8,2 | 95% |
| 15.03.2022 | Buffer Overflow | SonicOS | Kritisch 9,8 | 27% |
| 02.09.2026 | Server-Side Request Forgery | SMA1000 Appliances | Kritisch 10,0 | 8,0% |
| 02.09.2026 | OS Command Injection | SMA1000 Appliances | Hoch 7,8 | 9,9% |
| 14.07.2026 | Server-Side Request Forgery | SMA1000 Appliances | Kritisch 10,0 | 6,8% |
| 14.07.2026 | Code Injection | SMA1000 Appliances | Hoch 7,2 | 12% |
| 17.12.2025 | SMA1000 Missing Authorization | SMA1000 appliance | Mittel 6,6 | 2,8% |
| 01.05.2025 | OS Command Injection | SMA100 Appliances | Hoch 7,2 | 76% |
Quellen: Known Exploited Vulnerabilities (CISA, gemeinfrei), CVE records (cve.org) und EPSS (FIRST). Die Angriffswahrscheinlichkeit ist die EPSS-Schätzung, dass jemand in den nächsten 30 Tagen versucht, die Schwachstelle auszunutzen.