SonicWall warns of critical access control flaw in SonicOS

SonicWall's SonicOS is vulnerable to a critical access control flaw that could allow attackers to gain access unauthorized access to resources or cause the firewall to crash.

The flaw has received the identifier CVE-2024-40766 and a severity score of 9.3 according to the CVSS v3 standard, based on its network-based attack vector, low complexity, no authentication, and no user interaction requirements.

"An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash," reads SonicWall's bulletin.

"This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions."

Specific models impacted are: 

• Gen 5: SOHO devices running version 5.9.2.14-12o and older
• Gen 6: Various TZ, NSA, and SM models running versions 6.5.4.14-109n and older
• Gen 7: TZ and NSA models running SonicOS build version 7.0.1-5035 and older

cve-2024-40766="" sonicwall-sonicos-improper-access-control-vulnerability="" "="" title="SonicWall SonicOS Improper Access Control Vulnerability">CVE-2024-40766" src="/images/2024/08/26/0713bc9c74d78f70ac764493e152499d.png">

It is recommended that system administrators move to the below versions, which address CVE-2024-40766:

• For Gen 5: Version 5.9.2.14-13o
• For Gen 6: Version 6.5.4.15.116n
• For SM9800, NSsp 12400, and NSsp 12800, version 6.5.2.8-2n is safe
• For Gen 7: Any SonicOS firmware version higher than 7.0.1-5035

The security updates have been made available for download through mysonicwall.com.

Those who cannot apply the fixes immediately are recommended to restrict firewall management access to trusted sources or disable WAN management access from the internet. More information on how to do this can be found on SonicWall's help page.

SonicWall firewalls are widely used in a broad range of mission-critical industries and corporate environments and are commonly targeted by threat actors to gain initial access to corporate networks.

In March 2023, suspected Chinese hackers tracked as UNC4540 attacked SonicWall Secure Mobile Access (SMA) appliances with custom malware that could persist through firmware upgrades.

The US Cybersecurity & Infrastructure Security Agency (CISA) has warned about active exploitation of flaws impacting SonicWall appliances since 2022.