Attacker Value
Very High
(2 users assessed)
Exploitability
High
(2 users assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Network
2

CVE-2024-40766

Disclosure Date: August 23, 2024
Exploited in the Wild
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Initial Access
Techniques
Validation
Validated

Description

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

Add Assessment

3
Ratings
Technical Analysis

On August 22, 2024, SonicWall published an advisory for an improper access control vulnerability affecting multiple models in their Next Generation Firewall (NGFW) series of devices, specifically those running SonicOS v5, v6 and the latest version v7:

  • 5.9.2.14-12o and below.
  • 6.5.4.14-109n and below.
  • 7.0.1-5035 and below.

The vendor also states:

This vulnerability is not reproducible in SonicOS firmware version higher than 7.0.1-5035

We can note that the next version greater than 7.0.1-5035 is 7.0.1-5052 which was released on April 2022, indicating this vulnerability has not affected the latest firmware version of generation 7 Sonicwall NGFW devices for the last 2 years.

The description of the vulnerability from the vendor states that the improper access control vulnerability is in the management access feature of the device, and can lead to either resource access or denial of service.

There are no technical detail to go on, so looking at the vendor supplied CVSS score of 9.3, we can see this vulnerability has been rated as unauthenticated, and allows for both changed scope and a high loss of confidentiality. However we can note that the loss of integrity is rated as none. It would seem based on this, that the vulnerability does not lead to RCE on the target device, but rather it is likely an information leak that can cause an attacker to access resources beyond the initial scope.

We can see SonicWall have updated their advisory to state:

SonicWall strongly advises that customers using GEN5 and GEN6 firewalls with SSLVPN users who have locally managed accounts immediately update their passwords to enhance security and prevent unauthorized access

Given there are no technical details available, we can speculate based on what little we know about the vulnerability. It is likely this vulnerability allows an unauthenticated attacker to leak the credentials of either some, or all, local user accounts on the target devices, and if the SSLVPN feature allows authentication based on local accounts, the attacker may be able to reuse these credentials to authenticate and VPN into the devices internal network. This would make sense given the CVSS score indicating the scope is changed. If an attacker can indeed leak local user account credentials, it is unknown if the attacker must first crack hashed password before reuse, or if some other mechanism for authentication will work, for example, if the leaked resource is not a hashed password, but rather a session token.

Organizations running affected devices can apply the vendor update. Additionally, the vendor recommends both disabling the management access feature on the WAN interface of the device, and enabling MFA for all SSLVPN users.

Given there are currently no technical details or PoC’s available, I have not rated the exploitability. The attacker value is high as the scope of access can be changed.

1
Ratings
  • Attacker Value
    Very High
  • Exploitability
    High
Technical Analysis

Many reports have been made of the Akira and/or Fog ransomware group abusing this vulnerability. In this blog: https://arcticwolf.com/resources/blog/arctic-wolf-observes-akira-ransomware-campaign-targeting-sonicwall-sslvpn-accounts/ the abuse of the vulnerability by the Akira group is mentioned.

CVSS V3 Severity and Metrics
Base Score:
9.8 Critical
Impact Score:
5.9
Exploitability Score:
3.9
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • sonicwall

Products

  • sonicos

Exploited in the Wild

Reported by:

Additional Info

Technical Analysis