SonicWall is warning customers that a recently patched SonicOS vulnerability tracked as CVE-2024-40766 may be exploited in the wild.
CVE-2024-40766 was disclosed on August 22, when Sonicwall announced the availability of patches for each impacted product series, including Gen 5, Gen 6 and Gen 7 firewalls.
The security hole, described as an improper access control issue in the SonicOS management access and SSLVPN, can lead to unauthorized resource access and in some cases it can cause the firewall to crash.
SonicWall updated its advisory on Friday to inform customers that “this vulnerability is potentially being exploited in the wild”.
A large number of SonicWall appliances are exposed to the internet, but it’s unclear how many of them are vulnerable to attacks exploiting CVE-2024-40766. Customers are advised to patch their devices as soon as possible.
In addition, SonicWall noted in its advisory that it “strongly advises that customers using GEN5 and GEN6 firewalls with SSLVPN users who have locally managed accounts immediately update their passwords to enhance security and prevent unauthorized access.”
SecurityWeek has not seen any information on attacks that may involve exploitation of CVE-2024-40766.
Threat actors have been known to exploit SonicWall product vulnerabilities, including zero-days. Last year, Mandiant reported that it had identified sophisticated malware believed to be of Chinese origin on a SonicWall appliance.
Related: 180k Internet-Exposed SonicWall Firewalls Vulnerable to DoS Attacks, Possibly RCE
Related: SonicWall Patches Critical Vulnerabilities in GMS, Analytics Products
Related: SonicWall Patches Critical Vulnerability in Firewall Appliances
