Critical SonicWall CVE-2024-40766 flaw exploited in attacks. Apply patches now to protect against unauthorized access and firewall crashes
Continue reading
A critical access control flaw, CVE-2024-40766, impacting SonicWall's firewall devices, is now actively exploited in the wild, according to an updated advisory from SonicWall. This vulnerability affects Gen 5, Gen 6, and Gen 7 devices, with a severity score of 9.3 (CVSS v3). SonicWall is urging administrators to immediately apply patches to prevent unauthorized access and potential network disruption.
Initially disclosed on August 22, 2024, the flaw was thought to be limited to SonicOS management access. However, a recent update reveals that SSLVPN functionalities are also vulnerable. SonicWall warns that threat actors may exploit this flaw to gain unauthorized access to critical network resources and crash firewalls, disabling essential security protections.
Although SonicWall hasn't provided specifics about how the flaw is exploited, historical attacks on similar SonicWall vulnerabilities have shown that cybercriminals frequently target SSLVPN endpoints due to their exposure on the internet for remote VPN access.
SonicWall has provided a detailed breakdown of affected devices and the corresponding patches:
| SonicWall Generation | Affected Versions | Fixed Version |
|---|---|---|
| Gen 5 | SonicOS 5.9.2.14-12o and older | SonicOS 5.9.2.14-13o |
| Gen 6 | SonicOS 6.5.4.14-109n and older | 6.5.2.8-2n (SM9800, NSsp 12400, NSsp 12800) <br> 6.5.4.15-116n (Other Gen 6 Firewalls) |
| Gen 7 | SonicOS 7.0.1-5035 and older | Non-reproducible in 7.0.1-5035 and later builds |
SonicWall has issued the following mitigation strategies to minimize the risk of exploitation while patches are being applied:
Limit management access to trusted internal sources and disable WAN portal access from the internet where possible.
Restrict SSLVPN access to trusted sources and disable SSLVPN entirely if not required.
For Gen 5 and Gen 6 devices, SSLVPN users with local accounts should update their passwords immediately. Admins should enable the "User must change password" feature for local accounts.
Implement MFA for all SSLVPN users, using Time-based One-Time Passwords (TOTP) or email-based OTPs. Detailed configuration guidance for enabling MFA is available from SonicWall.
Although SonicWall has not disclosed specific details on how CVE-2024-40766 is being actively exploited, historical evidence indicates that SonicWall's vulnerabilities are frequently targeted by threat actors. These actors take advantage of their internet exposure for remote access, as demonstrated by past incidents, such as the March 2023 campaign where suspected Chinese hackers (UNC4540) targeted unpatched SonicWall devices to deploy custom malware, which persisted through firmware upgrades.
Similar exploitation patterns could emerge, as SSLVPN vulnerabilities have been historically attractive targets for attackers seeking to compromise corporate networks, bypass firewall protections, and establish persistent footholds in enterprise systems.
Immediate patching is the most effective way to secure your network against this vulnerability. Admins are strongly encouraged to download the latest patch from MySonicWall.com and apply it to affected devices. Furthermore, admins should review SonicWall’s recommendations on reducing exposure, enhancing access controls, and enforcing multi-factor authentication for enhanced security.
For further details on patches, configurations, and advisories, visit SonicWall's official advisory page.
CVE-2024-40766 poses a critical risk to organizations using SonicWall firewall devices. As attacks exploiting this vulnerability have already been observed, swift patching and the application of mitigations are essential to prevent unauthorized access, disruption of network defenses, and potential data breaches. Organizations must take immediate action by applying the latest patches, restricting SSLVPN access, and enabling MFA to safeguard against potential attacks.
Splunk disclosed CVE-2026-20253, a critical pre-auth RCE flaw in Splunk Enterprise (CVSS 9.8) from insecure MongoDB defaults. Patches released; upgrade to 9.1.8, 9.2.5, or 9.3.2.
