SonicWall this week announced patches for multiple vulnerabilities in its firewalls, including two high-severity flaws that could lead to authentication bypass.
Tracked as CVE-2024-40762, the first issue exists because the authentication token generator in SonicOS versions running on tens of SSL-VPN firewalls uses a cryptographically weak pseudo-random number generator (PRNG) that could be predicted by attacks.
The second authentication bypass, tracked as CVE-2024-53704, is the result of an improper authentication issue in the SSLVPN authentication mechanism, and could be exploited remotely, the company says.
SonicWall says that tens of firewall models running SonicOS versions 7.1.x and 8.0.0-8035 are affected by these issues and urges users to update to SonicOS versions 7.1.3-7015 and 8.0.0-8037, which include patches for both.
The company also fixed CVE-2024-53706, a high-severity bug in the Gen7 SonicOS Cloud platform NSv (AWS and Azure editions) that could allow “a remote authenticated local low-privileged attacker to elevate privileges to ‘root’ and potentially lead to code execution”.
Additionally, SonicWall announced that SonicOS versions 6.5.5.1-6n and 7.0.1-5165 resolve CVE-2024-53705, a medium-severity server-side request forgery (SSRF) defect in the SonicOS SSH management interface.
The updates also contain fixes for multiple medium-severity vulnerabilities, including code execution and information disclosure flaws in SonicOS management, a SSL-VPN multi-factor authentication bypass, and a buffer overflow issue that could lead to denial-of-service and code execution.
To mitigate the risk posed by these vulnerabilities, users should ensure that access to the SSL-VPN firewalls is limited to trusted sources, or to disable SSL-VPN access from the internet entirely. To mitigate the MFA bypass, the LDAP schema settings should be modified to prevent authentication via UPN (User Principal Name).
SonicWall says it has no evidence that these vulnerabilities have been exploited in the wild, but urges users to update their firewalls to fixed software releases as soon as possible. Additional information can be found on the company’s security advisories page.
It’s not uncommon for threat actors to exploit vulnerabilities in SonicWall products.
Related: Exploitation of Recent Critical Apache Struts 2 Flaw Begins
Related: Vulnerabilities Expose mySCADA myPRO Systems to Remote Hacking
Related: U.S. Organizations Targeted by New Cybercrime Group With Sophisticated Malware
Related: Over 100 Vulnerabilities Patched in MyBB in Past 5 Years
