CVE-2024-40766

9.8

CRITICAL CVSS 3.1

SonicWall SonicOS Improper Access Control Vulnerability - [Actively Exploited]

Description

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

INFO

Published Date :

Aug. 23, 2024, 7:15 a.m.

Last Modified :

Sept. 16, 2024, 7:48 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Sep 30, 2024

Alert Date: Sep 09, 2024 | 349 days ago

Description :

SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.

Required Action :

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes :

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015; https://nvd.nist.gov/vuln/detail/CVE-2024-40766

Affected Products

The following products are affected by CVE-2024-40766 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Sonicwall	sonicos
2	Sonicwall	nsa_2700
3	Sonicwall	nsa_3700
4	Sonicwall	nsa_4700
5	Sonicwall	nsa_5700
6	Sonicwall	nsa_6700
7	Sonicwall	nssp_10700
8	Sonicwall	nssp_11700
9	Sonicwall	nssp_13700
10	Sonicwall	tz270
11	Sonicwall	tz270w
12	Sonicwall	tz370
13	Sonicwall	tz370w
14	Sonicwall	tz470
15	Sonicwall	tz470w
16	Sonicwall	tz570
17	Sonicwall	tz570p
18	Sonicwall	tz570w
19	Sonicwall	tz670
20	Sonicwall	soho
21	Sonicwall	nssp_12400
22	Sonicwall	nssp_12800
23	Sonicwall	sm9800
24	Sonicwall	nsa_2650
25	Sonicwall	nsa_3600
26	Sonicwall	nsa_3650
27	Sonicwall	nsa_4600
28	Sonicwall	nsa_4650
29	Sonicwall	nsa_5600
30	Sonicwall	nsa_5650
31	Sonicwall	nsa_6600
32	Sonicwall	nsa_6650
33	Sonicwall	sm_9200
34	Sonicwall	sm_9250
35	Sonicwall	sm_9400
36	Sonicwall	sm_9450
37	Sonicwall	sm_9600
38	Sonicwall	sm_9650
39	Sonicwall	soho_250
40	Sonicwall	soho_250w
41	Sonicwall	sohow
42	Sonicwall	tz_300
43	Sonicwall	tz_300p
44	Sonicwall	tz_300w
45	Sonicwall	tz_350
46	Sonicwall	tz_350w
47	Sonicwall	tz_400
48	Sonicwall	tz_400w
49	Sonicwall	tz_500
50	Sonicwall	tz_500w
51	Sonicwall	tz_600
52	Sonicwall	tz_600p

: Total Affected Vendor : 1 | Products : 52

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				[email protected]
	CVSS 3.1	CRITICAL				134c704f-9b21-4f2e-91b3-4a467353bcc0

Solution

This information is provided by the 3rd party feeds.

Upgrade to the relevant fixed version referenced in the vendor security advisory.

Public PoC/Exploit Available at Github

CVE-2024-40766 has a 2 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-40766.

URL	Resource
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015	Vendor Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-40766 is associated with the following CWEs:

CWE-284: Improper Access Control

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2024-40766 weaknesses.

CAPEC-19: Embedding Scripts within Scripts Embedding Scripts within Scripts CAPEC-441: Malicious Logic Insertion Malicious Logic Insertion CAPEC-478: Modification of Windows Service Configuration Modification of Windows Service Configuration CAPEC-479: Malicious Root Certificate Malicious Root Certificate CAPEC-502: Intent Spoof Intent Spoof CAPEC-503: WebView Exposure WebView Exposure CAPEC-536: Data Injected During Configuration Data Injected During Configuration CAPEC-546: Incomplete Data Deletion in a Multi-Tenant Environment Incomplete Data Deletion in a Multi-Tenant Environment CAPEC-550: Install New Service Install New Service CAPEC-551: Modify Existing Service Modify Existing Service CAPEC-552: Install Rootkit Install Rootkit CAPEC-556: Replace File Extension Handlers Replace File Extension Handlers CAPEC-558: Replace Trusted Executable Replace Trusted Executable CAPEC-562: Modify Shared File Modify Shared File CAPEC-563: Add Malicious File to Shared Webroot Add Malicious File to Shared Webroot CAPEC-564: Run Software at Logon Run Software at Logon CAPEC-578: Disable Security Software Disable Security Software

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

sonicwall/sonicos-automation

Scripts to help automate various administrative tasks

Python

Updated: 8 months ago

3 stars 1 fork 1 watcher

Born at : Sept. 17, 2024, 4:16 p.m. This repo has been linked 1 different CVEs too.

Ostorlab/KEV

Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.

cisa-kev vulnerability 0day cisa exploits

Updated: 2 weeks, 2 days ago

581 stars 42 fork 42 watcher

Born at : April 19, 2022, 8:58 a.m. This repo has been linked 1287 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-40766 vulnerability anywhere in the article.

CybersecurityNews

SonicWall Confirms No New SSLVPN 0-Day – Ransomware Attack Linked to Old Vulnerability

Cybersecurity firm SonicWall has officially addressed recent concerns about a potential new zero-day vulnerability in its Secure Sockets Layer Virtual Private Network (SSLVPN) products. In a statement ...