SonicWall addressed an improper access control issue in its firewalls
August 26, 2024
SonicWall addressed a critical flaw in its firewalls that could allow attackers to achieve unauthorized access to the devices.
SonicWall has released security updates to address a critical vulnerability, tracked as CVE-2024-40766 (CVSS score: 9.3), in its firewalls.
The vulnerability is an improper access control issue that resides in the SonicWall SonicOS management access.
“An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash.” reads the advisory published by the vendor. “This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.”
Below are the impacted versions:
| Impacted Platforms | Impacted Versions |
| SOHO (Gen 5) | 5.9.2.14-12o and older versions |
| Gen6 Firewalls -SOHOW, TZ 300, TZ 300W, TZ 400, TZ 400W, TZ 500, TZ 500W, TZ 600, NSA 2650,NSA 3600, NSA 3650, NSA 4600, NSA 4650, NSA 5600, NSA 5650, NSA 6600, NSA 6650, SM 9200, SM 9250,SM 9400, SM 9450, SM 9600, SM 9650, TZ 300P, TZ 600P, SOHO 250, SOHO 250W, TZ 350, TZ 350W | 6.5.4.14-109n and older versions |
| Gen7 Firewalls – TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W,TZ570P, TZ670, NSa 2700, NSa 3700,NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700 | SonicOS build version 7.0.1-5035 and older versions. * However SonicWall recommends youinstall the latest firmware. |
The following versions addressed the vulnerability:
- SOHO (Gen 5 Firewalls) – 5.9.2.14-13o
- Gen 6 Firewalls – 6.5.2.8-2n (for SM9800, NSsp 12400, and NSsp 12800) and 6.5.4.15.116n (for other Gen 6 Firewall appliances)
It’s unclear if threat actors are exploiting the vulnerability in the wild.
Users unable to address the issue should restrict firewall management access to trusted sources or disable WAN management access from the internet.
In March 2023, Mandiant researchers reported that alleged China-linked threat actors, tracked as UNC4540, deployed custom malware on a SonicWall SMA appliance. The malware allows attackers to steal user credentials, achieve persistence through firmware upgrades, and provides shell access.
The analysis of a compromised device revealed the presence of a set of files used by the attacker to gain highly privileged and available access to the appliance. The malicious code is composed of a series of bash scripts and a single ELF binary identified as a TinyShell variant.
The researchers believe that the threat actors have a deep understanding of the appliance.
The malware is well tailored to the system to provide stability and maintain persistence, even in the case of installation of firmware upgrades.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganin
(SecurityAffairs – hacking, SonicWall)