SonicWall · SonicOS
CVE-2020-5135
SonicWall SonicOS Buffer Overflow Vulnerability
What it is
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnerability affected SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
CISA: A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: April 5, 2022
- Added to the CISA list
- March 15, 2022
- Published
- October 12, 2020
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 27% in the top 2.0% of all known vulnerabilities
- Weakness
- CWE-120
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from SonicWall
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Feb 18, 2025 | SSLVPN Improper Authentication | SonicOS | High 8.2 | 95% |
| Sep 9, 2024 | Improper Access Control | SonicOS | Critical 9.3 | 18% |
| Sep 2, 2026 | Server-Side Request Forgery | SMA1000 Appliances | Critical 10.0 | 8.0% |
| Sep 2, 2026 | OS Command Injection | SMA1000 Appliances | High 7.8 | 9.9% |
| Jul 14, 2026 | Server-Side Request Forgery | SMA1000 Appliances | Critical 10.0 | 6.8% |
| Jul 14, 2026 | Code Injection | SMA1000 Appliances | High 7.2 | 12% |
| Dec 17, 2025 | SMA1000 Missing Authorization | SMA1000 appliance | Medium 6.6 | 2.8% |
| May 1, 2025 | OS Command Injection | SMA100 Appliances | High 7.2 | 76% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.