SonicWall: Recent SSLVPN activity not connected to a zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-38475 | Improper Output Escaping in Apache HTTP Server mod_rewrite Enables File Disclosure/Code Execution CVE-2024-38475 is an improper escaping of output flaw (CWE-116) in the mod_rewrite module of the Apache HTTP Server. It is triggered when mod_rewrite maps a request URL to a filesystem location and mishandles encoded characters, allowing a crafted request to reach files that the server is permitted to serve but that were never intentionally or directly reachable by any URL. An attacker can abuse this to disclose source code (for example, serving raw application files) or, depending on the server's configuration and handlers, achieve code execution. Any Apache HTTP Server deployment that uses mod_rewrite is potentially affected; the source data does not specify the vulnerable version range. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-01, confirming exploitation in the wild, and EPSS assigns it a 100% probability of exploitation within 30 days (100th percentile), though no public proof-of-concept is known and ransomware use is unconfirmed. Do: Inventory Apache HTTP Server deployments, prioritize internet-facing ones, and check whether mod_rewrite is in use (RewriteRule directives in server config, virtual hosts, or .htaccess files); upgrade to the vendor's fixed release, 2.4.60 or later. If immediate upgrade is not possible, follow vendor guidance to harden or constrain mod_rewrite rules, and treat the issue as actively exploited per CISA KEV, applying BOD 22-01 mitigations for cloud service usage or discontinuing use if mitigation is unavailable. | 9.1 | 100% | KEV |
| masslikely hundreds of thousands to over a million internet-exposed Apache HTTP Server instances, with only the mod_rewrite-enabled subset vulnerable | |
| CVE-2024-40766 | Improper Access Control in SonicWall SonicOS Management (Gen 5/6/7 Firewalls) CVE-2024-40766 is an improper access control flaw (CWE-284) in SonicWall SonicOS management access that can allow unauthorized access to protected resources and, under specific conditions, crash the affected firewall. It is network-exploitable without privileges or user interaction per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) and affects Gen 5 and Gen 6 appliances as well as Gen 7 devices running SonicOS 7.0.1-5035 or older. A successful attacker gains unauthorized access to resources behind or on the appliance and can potentially take the firewall offline, creating opportunities for follow-on attacks such as VPN account compromise and ransomware deployment. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-09-09 with known ransomware use, and recent reporting ties Akira ransomware activity — including MFA bypass on SonicWall VPNs affecting over 100 accounts — to this legacy bug combined with password reuse. No public PoC is known, but EPSS assigns an ~18.2% probability of exploitation within 30 days (97th percentile). Do: Upgrade Gen 7 appliances to SonicOS 7.0.1-5037 or later (the fixed release beyond the affected 7.0.1-5035) and move Gen 5/6 devices to the latest SonicOS release SonicWall supports for those generations; per CISA KEV guidance, apply vendor mitigations or discontinue use if patching is not possible. Restrict WAN-side management and SSLVPN access to trusted sources, audit VPN accounts for password reuse, rotate credentials and any locally stored recovery codes, and review logs for signs of Akira-related compromise such as MFA bypass or disabled EDR agents. | 9.8 | 18% | KEV ransomware |
| mass≈100,000–500,000 internet-exposed SonicWall firewalls/SSLVPN endpoints (installed base of 1M+ appliances) |
Full article744 words · extracted from therecord.media · click to collapse
Update 8/7/2025 at 2:00pm — SonicWall said in a statement that they have "high confidence that the recent SSLVPN activity is not connected to a zero-day vulnerability" and appears to be correlated to CVE-2024-40766, which was previously documented. The company said it is currently investigating less than 40 incidents related to the activity. Ransomware gangs may be exploiting an unknown vulnerability in SonicWall devices to launch attacks on dozens of organizations. Multiple incident response companies released warnings over the weekend about threat actors using the Akira ransomware to target SonicWall firewall devices for initial access. Experts at Arctic Wolf first revealed the incidents on Friday. SonicWall has not responded to repeated requests for comment about the breaches but published a blog post on Monday afternoon confirming that it is aware of the campaign. The company said Arctic Wolf, Google and Huntress have warned over the last 72 hours that there has been an increase in cyber incidents involving Gen 7 SonicWall firewalls that use the secure sockets layer (SSL) protocol. “We are actively investigating these incidents to determine whether they are connected to a previously disclosed vulnerability or if a new vulnerability may be responsible,” the company said. SonicWall said it is working with researchers, updating customers and will release updated firmware if a new vulnerability is found. The company echoed the advice of several security firms, telling customers to disable SonicWall VPN services that use the SSL protocol. Arctic Wolf said on Friday that it has seen multiple intrusions within a short period of time and all of them involved access through SonicWall SSL VPNs. “While credential access through brute force, dictionary attacks, and credential stuffing have not yet been definitively ruled out in all cases, available evidence points to the existence of a zero-day vulnerability,” the company said. None of the incident response companies have specified what that bug might be. “In some instances, fully patched SonicWall devices were affected following credential rotation,” Arctic Wolf said, referring to the process of regularly resetting logins or other access. The researchers added that the ransomware activity involving SonicWall VPNs began around July 15. When pressed on whether any recent known SonicWall vulnerabilities are to blame for the attacks, an Arctic Wolf spokesperson said the researchers have “seen fully patched devices affected in this campaign, leading us to believe that this is tied to a net new zero day vulnerability.” Arctic Wolf said in its advisory that given the high likelihood of such a bug, organizations “should consider disabling the SonicWall SSL VPN service until a patch is made available and deployed.” Over the weekend, Arctic Wolf’s assessment was backed up by incident responders at Huntress, who confirmed several incidents involving the SonicWall SSL VPN. A Huntress official said they have seen around 20 attacks since July 25 and many of the incidents include the abuse of privileged accounts, lateral movement, credential theft and ransomware deployment. “This is happening at a pace that suggests exploitation, possibly a zero day exploit in Sonicwall. Threat actors have gained control of accounts that even have MFA deployed,” the official said. He confirmed that the incidents Huntress examined also involved Akira ransomware. Huntress released a lengthy threat advisory on Monday warning of a “likely zero-day vulnerability in SonicWall VPNs” that was being used to facilitate ransomware attacks. Like Arctic Wolf, they urged customers to disable the VPN service immediately. “Over the last few days, the Huntress Security Operations Center (SOC) has been responding to a wave of high-severity incidents originating from SonicWall Secure Mobile Access (SMA) and firewall appliances,” Huntress explained. “This isn't isolated; we're seeing this alongside our peers at Arctic Wolf, Sophos, and other security firms. The speed and success of these attacks, even against environments with MFA enabled, strongly suggest a zero-day vulnerability is being exploited in the wild.” SonicWall devices are frequent targets for hackers because the types of appliances the company produces serve as gateways for secure remote access. Just two weeks ago, Google warned of a campaign targeting end-of-life SonicWall SMA 100 series appliances through a bug tracked as CVE-2024-38475. At least 20 incidents
'This isn't isolated'
No previous article
No new articles
Jonathan Greig
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/sonicwall-possible-zero-day-gen-7-firewalls-ssl-vpn