Pierluigi Paganini August 26, 2024

SonicWall addressed a critical flaw in its firewalls that could allow attackers to achieve unauthorized access to the devices.

SonicWall has released security updates to address a critical vulnerability, tracked as CVE-2024-40766 (CVSS score: 9.3), in its firewalls.

The vulnerability is an improper access control issue that resides in the SonicWall SonicOS management access.

“An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash.” reads the advisory published by the vendor. “This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.”

Below are the impacted versions:

The following versions addressed the vulnerability:

• SOHO (Gen 5 Firewalls) – 5.9.2.14-13o
• Gen 6 Firewalls – 6.5.2.8-2n (for SM9800, NSsp 12400, and NSsp 12800) and 6.5.4.15.116n (for other Gen 6 Firewall appliances)

It’s unclear if threat actors are exploiting the vulnerability in the wild.

Users unable to address the issue should restrict firewall management access to trusted sources or disable WAN management access from the internet.

In March 2023, Mandiant researchers reported that alleged China-linked threat actors, tracked as UNC4540, deployed custom malware on a SonicWall SMA appliance. The malware allows attackers to steal user credentials, achieve persistence through firmware upgrades, and provides shell access.

The analysis of a compromised device revealed the presence of a set of files used by the attacker to gain highly privileged and available access to the appliance. The malicious code is composed of a series of bash scripts and a single ELF binary identified as a TinyShell variant.

The researchers believe that the threat actors have a deep understanding of the appliance.

The malware is well tailored to the system to provide stability and maintain persistence, even in the case of installation of firmware upgrades.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganin

(SecurityAffairs – hacking, SonicWall)