Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

SonicWall Patches Critical SonicOS Vulnerability 

SonicWall has patched CVE-2024-40766, a critical SonicOS vulnerability that can lead to unauthorized access or a firewall crash.

SonicWall is warning customers that a critical vulnerability affecting its SonicOS network security appliance operating system can lead to unauthorized access or a firewall crash.

The flaw is tracked as CVE-2024-40766 and it has been described as an “improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash.”

According to the vendor, the vulnerability impacts SonicWall Gen 5, Gen 6 and Gen 7 firewalls. 

Updates that resolve the security hole are available for each impacted version. In the case of Gen7 products, SonicWall noted that the issue could not be reproduced on firmware versions higher than 7.0.1-5035, but users are still advised to install the latest version. 

No other information has been provided and the vendor has not mentioned anything about in-the-wild exploitation.

However, threat actors exploiting SonicWall product vulnerabilities is not unheard of so it’s important that customers patch their SonicOS instances as soon as possible. 

According to Netlas.io, there are roughly 650,000 internet-exposed instances of SonicWall firewalls, including over 400,000 in the United States. It’s unclear how many of them may be impacted by CVE-2024-40766.

Last year, Mandiant reported that it had identified sophisticated malware believed to be of Chinese origin on a SonicWall appliance.

Advertisement. Scroll to continue reading.

Related: 180k Internet-Exposed SonicWall Firewalls Vulnerable to DoS Attacks, Possibly RCE

Related: SonicWall Patches Critical Vulnerabilities in GMS, Analytics Products

Related: SonicWall Patches Critical Vulnerability in Firewall Appliances

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Hear from experts as they explore the latest trends, challenges and innovations in Attack Surface Management.

Register

Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Register

People on the Move

Janet Rathod has been named VP and CISO at Johns Hopkins University.

Barbara Larson has joined SentinelOne as Chief Financial Officer.

Amy Howland has been named Partner and CISO at Guidehouse.

More People On The Move

Expert Insights