SonicWall · SonicOS
CVE-2024-40766
SonicWall SonicOS Improper Access Control Vulnerability
Qué es
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
CISA: SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.
Qué hacer
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Plazo para las agencias federales de EE. UU.: 30 de septiembre de 2024
Más fallos explotados de SonicWall
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 18 feb 2025 | SSLVPN Improper Authentication | SonicOS | Alto 8,2 | 95% |
| 15 mar 2022 | Buffer Overflow | SonicOS | Crítica 9,8 | 27% |
| 2 sept 2026 | Server-Side Request Forgery | SMA1000 Appliances | Crítica 10,0 | 8,0% |
| 2 sept 2026 | OS Command Injection | SMA1000 Appliances | Alto 7,8 | 9,9% |
| 14 jul 2026 | Server-Side Request Forgery | SMA1000 Appliances | Crítica 10,0 | 6,8% |
| 14 jul 2026 | Code Injection | SMA1000 Appliances | Alto 7,2 | 12% |
| 17 dic 2025 | SMA1000 Missing Authorization | SMA1000 appliance | Media 6,6 | 2,8% |
| 1 may 2025 | OS Command Injection | SMA100 Appliances | Alto 7,2 | 76% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.