CISA says SonicWall bug being exploited as experts warn of ransomware gang use
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-40766 | Improper Access Control in SonicWall SonicOS Management (Gen 5/6/7 Firewalls) CVE-2024-40766 is an improper access control flaw (CWE-284) in SonicWall SonicOS management access that can allow unauthorized access to protected resources and, under specific conditions, crash the affected firewall. It is network-exploitable without privileges or user interaction per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) and affects Gen 5 and Gen 6 appliances as well as Gen 7 devices running SonicOS 7.0.1-5035 or older. A successful attacker gains unauthorized access to resources behind or on the appliance and can potentially take the firewall offline, creating opportunities for follow-on attacks such as VPN account compromise and ransomware deployment. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-09-09 with known ransomware use, and recent reporting ties Akira ransomware activity — including MFA bypass on SonicWall VPNs affecting over 100 accounts — to this legacy bug combined with password reuse. No public PoC is known, but EPSS assigns an ~18.2% probability of exploitation within 30 days (97th percentile). Do: Upgrade Gen 7 appliances to SonicOS 7.0.1-5037 or later (the fixed release beyond the affected 7.0.1-5035) and move Gen 5/6 devices to the latest SonicOS release SonicWall supports for those generations; per CISA KEV guidance, apply vendor mitigations or discontinue use if patching is not possible. Restrict WAN-side management and SSLVPN access to trusted sources, audit VPN accounts for password reuse, rotate credentials and any locally stored recovery codes, and review logs for signs of Akira-related compromise such as MFA bypass or disabled EDR agents. | 9.8 | 18% | KEV ransomware |
| mass≈100,000–500,000 internet-exposed SonicWall firewalls/SSLVPN endpoints (installed base of 1M+ appliances) |
Full article412 words · extracted from therecord.media · click to collapse
Federal cybersecurity experts are warning that a vulnerability affecting products from SonicWall is being exploited, and ordered all federal civilian agencies to implement a patch for the bug by the end of the month. The Cybersecurity and Infrastructure Security Agency (CISA) said on Monday that hackers are exploiting CVE-2024-40766 — a vulnerability affecting SonicWall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions. SonicWall said in its own advisory that the vulnerability allows “unauthorized resource access” and in some situations can cause the firewall to crash. They have also confirmed that it is being exploited by hackers and said patches have been released. For those unable to patch, SonicWall urged customers to ensure that access to the devices is limited or restricted from internet access. SonicWall gave the vulnerability a severity score of 9.3 out of 10. The CISA warning comes days after researchers at Arctic Wolf said it observed hackers connected to the Akira ransomware gang exploiting the vulnerability. CISA itself said it did not know if ransomware groups are exploiting the bug but Rapid7 confirmed on Monday that it has also seen ransomware actors exploiting it. Arctic Wolf researchers saw affiliates of the group using compromised accounts on SonicWall devices as the initial access vector to carry out ransomware attacks. “In each instance, the compromised accounts were local to the devices themselves rather than being integrated with a centralized authentication solution such as Microsoft Active Directory,” said Stefan Hostetler, senior threat intelligence researcher at Arctic Wolf. “Additionally, [multifactor authentication] was disabled for all compromised accounts, and the SonicOS firmware on the affected devices were within the versions known to be vulnerable to CVE-2024-40766.” Akira — responsible for attacks on Stanford University, cloud service Tietoevry and Yamaha — earned about $42 million in ransoms from attacks on at least 250 organizations since emerging in March 2023, according to the FBI. The large number of attacks launched by the group led experts to believe it is made up of experienced actors and previous reports from Akira showed links between the gang and the now-defunct ransomware gang Conti.
No previous article
No new articles
Jonathan Greig
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/cisa-orders-patching-of-sonicwall-bug-ransomware