CVE-2024-40766
critical · 9.8Actively exploitedOn the CISA Known Exploited Vulnerabilities catalog
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Added 2024-09-09Remediation due 2024-09-30
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
9.8
CVSS
18.2%
EPSS (exploit prob.)
97th
EPSS percentile
2024-08-23
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| sonicwall | sonicos | < 5.9.2.14-13o |
| sonicwall | soho | all versions |
| sonicwall | sonicos | < 6.5.2.8-2n |
| sonicwall | nssp_12400 | all versions |
| sonicwall | nssp_12800 | all versions |
| sonicwall | sm9800 | all versions |
| sonicwall | sonicos | < 6.5.4.15.116n |
| sonicwall | nsa_2650 | all versions |
| sonicwall | nsa_3600 | all versions |
| sonicwall | nsa_3650 | all versions |
| sonicwall | nsa_4600 | all versions |
| sonicwall | nsa_4650 | all versions |
| sonicwall | nsa_5600 | all versions |
| sonicwall | nsa_5650 | all versions |
| sonicwall | nsa_6600 | all versions |
| sonicwall | nsa_6650 | all versions |
| sonicwall | sm_9200 | all versions |
| sonicwall | sm_9250 | all versions |
| sonicwall | sm_9400 | all versions |
| sonicwall | sm_9450 | all versions |
| sonicwall | sm_9600 | all versions |
| sonicwall | sm_9650 | all versions |
| sonicwall | soho_250 | all versions |
| sonicwall | soho_250w | all versions |
| sonicwall | sohow | all versions |
| sonicwall | tz_300 | all versions |
| sonicwall | tz_300p | all versions |
| sonicwall | tz_300w | all versions |
| sonicwall | tz_350 | all versions |
| sonicwall | tz_350w | all versions |
| sonicwall | tz_400 | all versions |
| sonicwall | tz_400w | all versions |
| sonicwall | tz_500 | all versions |
| sonicwall | tz_500w | all versions |
| sonicwall | tz_600 | all versions |
| sonicwall | tz_600p | all versions |
| sonicwall | sonicos | <= 7.0.1-5035 |
| sonicwall | nsa_2700 | all versions |
| sonicwall | nsa_3700 | all versions |
| sonicwall | nsa_4700 | all versions |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2024-40766