SonicWall · SonicOS
CVE-2024-40766
SonicWall SonicOS Improper Access Control Vulnerability
What it is
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
CISA: SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: September 30, 2024
More exploited flaws from SonicWall
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Feb 18, 2025 | SSLVPN Improper Authentication | SonicOS | High 8.2 | 95% |
| Mar 15, 2022 | Buffer Overflow | SonicOS | Critical 9.8 | 27% |
| Sep 2, 2026 | Server-Side Request Forgery | SMA1000 Appliances | Critical 10.0 | 8.0% |
| Sep 2, 2026 | OS Command Injection | SMA1000 Appliances | High 7.8 | 9.9% |
| Jul 14, 2026 | Server-Side Request Forgery | SMA1000 Appliances | Critical 10.0 | 6.8% |
| Jul 14, 2026 | Code Injection | SMA1000 Appliances | High 7.2 | 12% |
| Dec 17, 2025 | SMA1000 Missing Authorization | SMA1000 appliance | Medium 6.6 | 2.8% |
| May 1, 2025 | OS Command Injection | SMA100 Appliances | High 7.2 | 76% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.