CVE-2024-40766

KEV · Ransomware

SonicWall SonicOS Improper Access Control Vulnerability

Vendor / Project: SonicWall
Product: SonicOS
Date added: Sep 9, 2024
Due date: Sep 30, 2024
Known ransomware use: Known
CWEs: CWE-284

Description

SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015
https://www.sonicwall.com/support/notices/gen-7-and-newer-sonicwall-firewalls-sslvpn-recent-threat-activity/kA1VN0000000RDG0A2
https://nvd.nist.gov/vuln/detail/CVE-2024-40766