CVE-2023-34137

—

CVSS 3.1

9.8 critical

EPSS

1%p61

Published

Jul 13, 2023 (Jul 13, 2023)

Modified

Jun 17, 2026

Description

SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks leading to authentication bypass vulnerability. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.

Vendors: sonicwall
Products: analytics, global management system
Weakness: CWE-305, CWE-287
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news2 stories

New Vulnerabilities Disclosed in SonicWall and Fortinet Network Security Products

The Hacker NewsJul 15, 00:00 UTC · Jul 15, 2023Vulnerability CVE-2023-34123 CVE-2023-34137 CVE-2023-34124+3 CVEs

SonicWall urges orgs to fix critical flaws in GMS/Analytics products

Security AffairsJul 13, 07:55 UTC · Jul 13, 2023Exploit / PoC CVE-2023-34124 CVE-2023-34134 CVE-2023-34137