Loading story…
SonicWall warned that multiple critical flaws in Gen 6, Gen 6.5, Gen 7, and TZ80 firewalls could allow authentication bypass, arbitrary outbound connections, privileged access, and possible remote code execution on exposed devices. The disclosed issues include CVE-2024-40762, CVE-2024-53704, CVE-2024-53705, and CVE-2024-53706, with guidance to immediately install vendor updates and, if patching is delayed, disable Internet-exposed SSLVPN or restrict access to trusted sources. Authorities also urged organizations to review logs for suspicious local-user login attempts and other anomalous access patterns.
Subsequent incident reporting tied real-world compromises of SonicWall Gen 7 firewalls with SSLVPN enabled to CVE-2024-40766 and password-related weaknesses introduced during Gen 6 to Gen 7 migrations, rather than to a new zero-day as initially feared. SonicWall said many successful intrusions appeared to involve migrated local user passwords that had not been reset, creating an opening for network breaches and potential ransomware activity. Recommended mitigations include upgrading to firmware 7.3.0, resetting local SSLVPN user passwords, disabling unused accounts, enabling MFA, Botnet Protection, and Geo-IP Filtering, and limiting SSLVPN access by IP where the service remains necessary.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2025-08-07, SonicWall updated its guidance and said the investigated activity was not caused by a zero-day. Instead, it tied successful compromises to CVE-2024-40766 and password-related weaknesses affecting local users migrated from Gen 6 to Gen 7 when passwords had not been reset.
On 2025-08-06, Finland's National Cyber Security Centre published an alert that SonicWall Gen 7 SSLVPN weaknesses were being exploited in breaches and urged organizations to inspect exposed devices for signs of compromise. It said it was not aware of successful exploitation in Finland at that time and recommended mitigations such as firmware upgrades, password resets, MFA, and disabling unnecessary SSLVPN access.
On 2025-08-04, SonicWall warned that a possible zero-day affecting Gen 7 firewalls with SSLVPN enabled may have been used in multiple intrusions. The activity was described as potentially enabling arbitrary code execution, network compromise, and ransomware attacks.
On 2025-01-07, SonicWall disclosed five vulnerabilities affecting Gen 6, Gen 6.5, Gen 7, and TZ80 firewall products, including authentication bypass, SSRF, weak randomness, and cloud NSv issues. The company issued software updates and advised customers to patch immediately or restrict Internet-exposed SSLVPN access.
On 2024-08-22, SonicWall released fixes for CVE-2024-40766, a remote code execution vulnerability affecting Gen 5 and Gen 6 firewalls and Gen 7 devices running SonicOS 7.0.1-5035 or earlier. The flaw exposed management interfaces and, as later clarified, local SSLVPN accounts on affected unpatched devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
kyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SonicWall issued fixes for multiple high-severity SonicOS vulnerabilities affecting Gen6, Gen7, NSv, and TZ80 firewalls, led by **`CVE-2024-53704`**, a critical SSL VPN authentication bypass that lets a remote, unauthenticated attacker hijack an active VPN session with a crafted session cookie. Successful exploitation can give an attacker the victim’s internal network access, expose Virtual Office bookmarks, allow retrieval of a NetExtender client profile, and enable establishment of a VPN tunnel; the attacker can also terminate the legitimate user’s session. Additional patched flaws include privilege escalation, token prediction that can lead to unauthorized access, and SSRF through the SSH management interface. Bishop Fox later published technical analysis and a working exploit for `CVE-2024-53704`, reporting that exploitation becomes trivial once the flaw is understood and relies on crafted Base64-encoded session cookies containing null bytes. The researchers said roughly 4,500 internet-facing SonicWall SSL VPN servers remained unpatched in early February 2025, increasing exposure, while CSIRT.SK warned that public exploit details raise the likelihood of targeted attacks. SonicWall and downstream defenders urged immediate firmware upgrades and tighter restriction of firewall management interfaces, noting that detection is difficult but that SSL VPN logs showing the same session used from multiple source IP addresses may indicate hijacking.
Jul 24, 2026
SonicWall disclosed multiple vulnerabilities in **SonicOS** affecting Generation 6, 7, and 8 hardware and virtual firewall products, including flaws that could let attackers bypass access controls, reach restricted services, or trigger denial of service by crashing firewalls. The issues, identified by CrowdStrike’s Advanced Research Team and tracked as `CVE-2026-0204`, `CVE-2026-0205`, and `CVE-2026-0206`, carry CVSS scores of **8.0**, **6.8**, and **4.9** respectively, and were also reflected in advisory **dCERT 2026-1294**. SonicWall released fixed firmware versions and urged administrators to apply updates immediately. Where patching cannot be completed at once, the company advised disabling **HTTP/HTTPS management** and **SSLVPN** on all interfaces and restricting management access to **SSH**. SonicWall also warned Generation 6 customers not to downgrade from patched firmware, saying a rollback will delete LDAP users and reset MFA configurations.
Jun 29, 2026
SonicWall has disclosed a critical buffer overflow vulnerability, tracked as CVE-2025-40601, in the SSLVPN service of its SonicOS operating system. This flaw allows remote, unauthenticated attackers to trigger a firewall crash, resulting in a Denial-of-Service (DoS) condition. The vulnerability affects both hardware and virtual firewalls in the Gen7 and Gen8 product lines, including models such as TZ270–TZ670, NSa 2700–6700, NSsp 10700–15700, and their virtual equivalents on platforms like ESX, KVM, Hyper-V, AWS, and Azure. The issue is present in software versions Gen7 7.3.0-7012 and older, and Gen8 8.0.2-8011 and older, but does not impact Gen6 or SMA series devices. SonicWall has released patches to address the vulnerability and recommends immediate updates for affected systems. There is currently no evidence of active exploitation or remote code execution capabilities associated with this flaw; the primary risk is service disruption due to firewall crashes. Administrators are urged to verify whether the SSLVPN interface is enabled and to apply the necessary security updates to mitigate potential DoS attacks targeting this vulnerability.
Jun 29, 2026