CVEs / CVE-2024-40766
CVE-2024-40766: SonicWall SonicOS Improper Access Control Vulnerability
- Known exploited in the CISA KEV catalog since 9 Sep 2024
- critical 9.8 CVSS 3.1 (NVD)
- EPSS 18.3% chance of exploitation in the next 30 days, higher than 97% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2024-40766
Summary
SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.
Description
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| SonicWall SonicOS | 5.9.2.14-12o and older versions | — |
| SonicWall SonicOS | 6.5.4.14-109n and older versions | — |
| SonicWall SonicOS | 7.0.1-5035 and older versions | — |
Exploitation
| In CISA KEV since | 9 Sep 2024 |
|---|---|
| Due date for US federal agencies | 30 Sep 2024 |
| Used in ransomware campaigns | Known |
| Required action | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HScored by NVD |
|---|---|
| Weakness | CWE-284 |
References
- CVE-2024-40766 on NVD
- CVE-2024-40766 in the CISA KEV catalog
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015 (cited by CISA)
- https://www.sonicwall.com/support/notices/gen-7-and-newer-sonicwall-firewalls-sslvpn-recent-threat-activity/kA1VN0000000RDG0A2 (cited by CISA)
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40766 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.