CVE-2024-40766

SonicWall · Published August 23, 2024

9.8

CVSS v3.1

CRITICAL

CISA KEV — Federal agencies must patch by deadline

Actively exploited in the wild

Patch availableGet patch

Description

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

Affected Products

Sonicos < 5.9.2.14-13o
Sonicos < 6.5.2.8-2n
Sonicos < 6.5.4.15.116n
Sonicos <= 7.0.1-5035

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H