Loading story…
SonicWall issued fixes for multiple high-severity SonicOS vulnerabilities affecting Gen6, Gen7, NSv, and TZ80 firewalls, led by CVE-2024-53704, a critical SSL VPN authentication bypass that lets a remote, unauthenticated attacker hijack an active VPN session with a crafted session cookie. Successful exploitation can give an attacker the victim’s internal network access, expose Virtual Office bookmarks, allow retrieval of a NetExtender client profile, and enable establishment of a VPN tunnel; the attacker can also terminate the legitimate user’s session. Additional patched flaws include privilege escalation, token prediction that can lead to unauthorized access, and SSRF through the SSH management interface.
Bishop Fox later published technical analysis and a working exploit for CVE-2024-53704, reporting that exploitation becomes trivial once the flaw is understood and relies on crafted Base64-encoded session cookies containing null bytes. The researchers said roughly 4,500 internet-facing SonicWall SSL VPN servers remained unpatched in early February 2025, increasing exposure, while CSIRT.SK warned that public exploit details raise the likelihood of targeted attacks. SonicWall and downstream defenders urged immediate firmware upgrades and tighter restriction of firewall management interfaces, noting that detection is difficult but that SSL VPN logs showing the same session used from multiple source IP addresses may indicate hijacking.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Bishop Fox demonstrated practical exploitation of CVE-2024-53704, showing that a remote unauthenticated attacker can hijack active SonicWall SSL VPN sessions using crafted Base64-encoded session cookies containing null bytes. The publication also described post-hijack access possibilities such as reaching internal networks, reading bookmarks, retrieving NetExtender profiles, and establishing a VPN tunnel.
As of February 7, 2025, Bishop Fox reported that internet scans identified roughly 4,500 internet-facing SonicWall SSL VPN servers that remained unpatched for CVE-2024-53704. The finding highlighted continued exposure after SonicWall's fixes were available.
On January 7, 2025, SonicWall published advisory SNWLID-2025-0003 and released security updates for SonicOS-based firewalls addressing four high-severity vulnerabilities, including CVE-2024-53704 in SSL VPN. The advisory initially stated there was no evidence of in-the-wild exploitation and urged administrators to apply firmware updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcebishopfox.com
Open sourcepsirt.global.sonicwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SonicWall warned that multiple critical flaws in **Gen 6, Gen 6.5, Gen 7, and TZ80** firewalls could allow authentication bypass, arbitrary outbound connections, privileged access, and possible remote code execution on exposed devices. The disclosed issues include **`CVE-2024-40762`**, **`CVE-2024-53704`**, **`CVE-2024-53705`**, and **`CVE-2024-53706`**, with guidance to immediately install vendor updates and, if patching is delayed, disable Internet-exposed **SSLVPN** or restrict access to trusted sources. Authorities also urged organizations to review logs for suspicious local-user login attempts and other anomalous access patterns. Subsequent incident reporting tied real-world compromises of **SonicWall Gen 7** firewalls with **SSLVPN** enabled to **`CVE-2024-40766`** and password-related weaknesses introduced during **Gen 6 to Gen 7** migrations, rather than to a new zero-day as initially feared. SonicWall said many successful intrusions appeared to involve migrated local user passwords that had not been reset, creating an opening for network breaches and potential ransomware activity. Recommended mitigations include upgrading to **firmware 7.3.0**, resetting local SSLVPN user passwords, disabling unused accounts, enabling **MFA**, Botnet Protection, and Geo-IP Filtering, and limiting SSLVPN access by IP where the service remains necessary.
Jun 29, 2026
SonicWall disclosed multiple vulnerabilities in **SonicOS** affecting Generation 6, 7, and 8 hardware and virtual firewall products, including flaws that could let attackers bypass access controls, reach restricted services, or trigger denial of service by crashing firewalls. The issues, identified by CrowdStrike’s Advanced Research Team and tracked as `CVE-2026-0204`, `CVE-2026-0205`, and `CVE-2026-0206`, carry CVSS scores of **8.0**, **6.8**, and **4.9** respectively, and were also reflected in advisory **dCERT 2026-1294**. SonicWall released fixed firmware versions and urged administrators to apply updates immediately. Where patching cannot be completed at once, the company advised disabling **HTTP/HTTPS management** and **SSLVPN** on all interfaces and restricting management access to **SSH**. SonicWall also warned Generation 6 customers not to downgrade from patched firmware, saying a rollback will delete LDAP users and reset MFA configurations.
Jun 29, 2026
SonicWall has disclosed a critical buffer overflow vulnerability, tracked as CVE-2025-40601, in the SSLVPN service of its SonicOS operating system. This flaw allows remote, unauthenticated attackers to trigger a firewall crash, resulting in a Denial-of-Service (DoS) condition. The vulnerability affects both hardware and virtual firewalls in the Gen7 and Gen8 product lines, including models such as TZ270–TZ670, NSa 2700–6700, NSsp 10700–15700, and their virtual equivalents on platforms like ESX, KVM, Hyper-V, AWS, and Azure. The issue is present in software versions Gen7 7.3.0-7012 and older, and Gen8 8.0.2-8011 and older, but does not impact Gen6 or SMA series devices. SonicWall has released patches to address the vulnerability and recommends immediate updates for affected systems. There is currently no evidence of active exploitation or remote code execution capabilities associated with this flaw; the primary risk is service disruption due to firewall crashes. Administrators are urged to verify whether the SSLVPN interface is enabled and to apply the necessary security updates to mitigate potential DoS attacks targeting this vulnerability.
Jun 29, 2026