Loading vulnerability…
Remote Code Execution in SonicWall Global Management System XML-RPC
CVE-2018-9866 is a remote code execution vulnerability affecting SonicWall Global Management System (GMS) virtual appliance version 8.1 and earlier. The flaw is caused by insufficient validation and sanitization of user-supplied parameters passed to XML-RPC calls, specifically reported in connection with the set_time_config method. An unauthenticated remote attacker can send crafted XML-RPC requests containing malicious input that is not properly validated by the appliance, resulting in arbitrary command or code execution on the target system.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows remote arbitrary code execution on the vulnerable SonicWall GMS virtual appliance. This can enable full compromise of the management system, including execution of attacker-controlled commands, installation of malware, use of the appliance as a foothold for further intrusion, and potential disruption or manipulation of centralized management functions.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict network access to the XML-RPC management interface to trusted administrative hosts only, prevent exposure of the vulnerable service to untrusted networks, and apply segmentation and access controls around the GMS appliance. Monitoring for unexpected XML-RPC activity and isolating or decommissioning unsupported GMS instances can reduce exposure until remediation is completed.
Patch, then assume compromise.
Upgrade SonicWall Global Management System to a fixed, supported release that addresses CVE-2018-9866. Versions 8.1 and earlier are affected, and the issue was reported as affecting older, unsupported releases. Organizations should follow SonicWall vendor guidance and migrate away from unsupported GMS versions to maintained builds that include the security fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.