60
CVE-2024-53704
Authentication Bypass in SonicWall SonicOS SSLVPN
CISA: SonicWall SonicOS SSLVPN Improper Authentication Vulnerability
- CVSS 3.1
- 9.8 critical
- EPSS
- 95%p100
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2024-53704 is a critical (CVSS 9.8) improper authentication flaw (CWE-287) in the SSLVPN authentication mechanism of SonicWall's SonicOS. A remote, unauthenticated attacker can exploit it over the network without user interaction, bypassing SSLVPN authentication to gain unauthorized access to the VPN and a foothold into protected internal networks. CISA notes known ransomware use, making this a high-value entry point for follow-on attacks. Any organization running SonicWall SonicOS with SSLVPN enabled is affected. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-02-18, public scans show 5,000+ internet-exposed SonicWall firewalls still unpatched, and EPSS rates the 30-day exploitation probability at 95.1%.
What to do: Upgrade affected SonicOS deployments to the patched releases listed in SonicWall's advisory, prioritizing internet-facing SSLVPN endpoints. Until patched, restrict or disable SSLVPN exposure where feasible and hunt for signs of exploitation, since ransomware use is known. Remediation must satisfy CISA KEV required actions (apply vendor mitigations or discontinue use).
| Product | Affected |
|---|---|
| SonicWall SonicOS | — |
Estimated exposure
largeestimated tens of thousands of SSLVPN-enabled SonicWall firewall deployments, with at least ~5,000 confirmed still exposed and unpatched on the public internet — Public internet scans reported 5,000+ SonicWall firewalls still vulnerable to CVE-2024-53704, and SonicWall's widely deployed firewall install base, where SSLVPN is commonly enabled, plausibly puts total affected deployments in the tens of…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
KEVCISA Known Exploited Vulnerability
- Affected
- SonicWall SonicOS
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Due date
- Ransomware use
- Known
In the news
11 stories60
CISA Adds Palo Alto Networks and SonicWall Flaws to Exploited Vulnerabilities List
60
60
60
60
60
60
60
60
60