9.8

CVE-2024-53704

Warnung
Medienbericht
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sonicwall ≫ Sonicos Version >= 7.1.1-7040 <= 7.1.1-7058
   Sonicwall ≫ Nsa 2700 Version -
   Sonicwall ≫ Nsa 3700 Version -
   Sonicwall ≫ Nsa 4700 Version -
   Sonicwall ≫ Nsa 5700 Version -
   Sonicwall ≫ Nsa 6700 Version -
   Sonicwall ≫ Nssp 10700 Version -
   Sonicwall ≫ Nssp 11700 Version -
   Sonicwall ≫ Nssp 13700 Version -
   Sonicwall ≫ Nssp 15700 Version -
   Sonicwall ≫ Nsv 270 Version -
   Sonicwall ≫ Nsv 470 Version -
   Sonicwall ≫ Nsv 870 Version -
   Sonicwall ≫ Tz270 Version -
   Sonicwall ≫ Tz270w Version -
   Sonicwall ≫ Tz370 Version -
   Sonicwall ≫ Tz370w Version -
   Sonicwall ≫ Tz470 Version -
   Sonicwall ≫ Tz470w Version -
   Sonicwall ≫ Tz570 Version -
   Sonicwall ≫ Tz570p Version -
   Sonicwall ≫ Tz570w Version -
   Sonicwall ≫ Tz670 Version -
Sonicwall ≫ Sonicos Version 7.1.2-7019
   Sonicwall ≫ Nsa 2700 Version -
   Sonicwall ≫ Nsa 3700 Version -
   Sonicwall ≫ Nsa 4700 Version -
   Sonicwall ≫ Nsa 5700 Version -
   Sonicwall ≫ Nsa 6700 Version -
   Sonicwall ≫ Nssp 10700 Version -
   Sonicwall ≫ Nssp 11700 Version -
   Sonicwall ≫ Nssp 13700 Version -
   Sonicwall ≫ Nssp 15700 Version -
   Sonicwall ≫ Nsv 270 Version -
   Sonicwall ≫ Nsv 470 Version -
   Sonicwall ≫ Nsv 870 Version -
   Sonicwall ≫ Tz270 Version -
   Sonicwall ≫ Tz270w Version -
   Sonicwall ≫ Tz370 Version -
   Sonicwall ≫ Tz370w Version -
   Sonicwall ≫ Tz470 Version -
   Sonicwall ≫ Tz470w Version -
   Sonicwall ≫ Tz570 Version -
   Sonicwall ≫ Tz570p Version -
   Sonicwall ≫ Tz570w Version -
   Sonicwall ≫ Tz670 Version -
Sonicwall ≫ Sonicos Version 8.0.0-8035
   Sonicwall ≫ Tz80 Version -

18.02.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

SonicWall SonicOS SSLVPN Improper Authentication Vulnerability

Schwachstelle

SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.

Beschreibung

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 95.13% 0.999
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADP 8.2 3.9 4.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
09.08.2025 11:36
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0003
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-53704
US Government Resource