CVE-2024-53704

SonicWall SonicOS SSLVPN Improper Authentication Vulnerability

Exploited in attacks Used by ransomware High 8.2 Attack chance: 95%

What it is

An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.

CISA: SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: March 11, 2025

psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0003

Added to the CISA list: February 18, 2025
Published: January 9, 2025
Severity: High 8.2 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 95% in the top 0.1% of all known vulnerabilities
Weakness: CWE-287
More details: NVD · CVE.org · CISA

More exploited flaws from SonicWall

Added	Vulnerability	Product	Severity	Attack chance
Sep 9, 2024	Improper Access ControlCVE-2024-40766used by ransomware	SonicOS	Critical 9.3	18%
Mar 15, 2022	Buffer OverflowCVE-2020-5135used by ransomware	SonicOS	Critical 9.8	27%
Sep 2, 2026	Server-Side Request ForgeryCVE-2026-83548	SMA1000 Appliances	Critical 10.0	8.0%
Sep 2, 2026	OS Command InjectionCVE-2026-83549	SMA1000 Appliances	High 7.8	9.9%
Jul 14, 2026	Server-Side Request ForgeryCVE-2026-15409used by ransomware	SMA1000 Appliances	Critical 10.0	6.8%
Jul 14, 2026	Code InjectionCVE-2026-15410used by ransomware	SMA1000 Appliances	High 7.2	12%
Dec 17, 2025	SMA1000 Missing AuthorizationCVE-2025-40602	SMA1000 appliance	Medium 6.6	2.8%
May 1, 2025	OS Command InjectionCVE-2023-44221	SMA100 Appliances	High 7.2	76%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.