SonicWall pushes patch for critical vulnerability in SonicOS platform 

Network security company SonicWall has identified a critical vulnerability in its SonicOS platform that can be exploited to gain unauthorized access, and in certain conditions, cause the company’s firewalls to crash. 

In a security advisory issued Thursday, the company gives the vulnerability (tracked as CVE-2024-40766) a CVSS score of 9.3. The related entry in the National Vulnerability Database does not have a score assigned as of this article’s publication. 

SonicWall says the issue affects its Gen 5 and Gen 6 firewall devices, as well as Generation 7 firewall devices that are operating on SonicOS version 7.0.1-5035 and earlier.

A company representative told CyberScoop that all potential customers and partners have been notified, and patches have been released. Security teams can further reduce risk by limiting SonicOS access to trusted accounts, or turning off the ability to manage firewall devices over the internet. 

In the past, threat actors have targeted unpatched SonicWall vulnerabilities for various schemes. In March 2023, Mandiant detected a suspected Chinese campaign using malware on unpatched SonicWall Secure Mobile Access (SMA) appliances to steal user credentials, provide shell access, and persist through firmware upgrades. The company has also warned in the past that unpatched security appliances have been targeted in attempted ransomware attacks. 

Below is a list of the affected products:

You can read the full SonicWall advisory in the company’s security information hub.