CVE-2024-53704

Warnung

Medienbericht

EPSS 93.82%
Veröffentlicht 09.01.2025 07:15:27
Zuletzt bearbeitet 19.02.2025 15:33:49
Quelle PSIRT@sonicwall.com
Teams Watchlist Login
Unerledigt Login

An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.

Betroffene Produkte Warnungen 2 Metriken 3 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Sonicwall ≫ Sonicos Version >= 7.1.1-7040 <= 7.1.1-7058

   Sonicwall ≫ Nsa 2700 Version-
   Sonicwall ≫ Nsa 3700 Version-
   Sonicwall ≫ Nsa 4700 Version-
   Sonicwall ≫ Nsa 5700 Version-
   Sonicwall ≫ Nsa 6700 Version-
   Sonicwall ≫ Nssp 10700 Version-
   Sonicwall ≫ Nssp 11700 Version-
   Sonicwall ≫ Nssp 13700 Version-
   Sonicwall ≫ Nssp 15700 Version-
   Sonicwall ≫ Nsv 270 Version-
   Sonicwall ≫ Nsv 470 Version-
   Sonicwall ≫ Nsv 870 Version-
   Sonicwall ≫ Tz270 Version-
   Sonicwall ≫ Tz270w Version-
   Sonicwall ≫ Tz370 Version-
   Sonicwall ≫ Tz370w Version-
   Sonicwall ≫ Tz470 Version-
   Sonicwall ≫ Tz470w Version-
   Sonicwall ≫ Tz570 Version-
   Sonicwall ≫ Tz570p Version-
   Sonicwall ≫ Tz570w Version-
   Sonicwall ≫ Tz670 Version-

Sonicwall ≫ Sonicos Version7.1.2-7019

Sonicwall ≫ Sonicos Version8.0.0-8035

Sonicwall ≫ Tz80 Version-

18.02.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

SonicWall SonicOS SSLVPN Improper Authentication Vulnerability

Schwachstelle

SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.

Beschreibung

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen

07.01.2025: CERT.at Warnung

https://www.cert.at/de/warnungen/2025/1/schwewiegende-sicherheitslucken-in-sonicwall-ssl-vpn-aktiv-ausgenutzt

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	93.82%	0.999

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0	8.2	3.9	4.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://www.heise.de/news/Sonicwall-Netextender-Sicherheitslecks-gefaehrden-Windows-Client-10349117.html

Medienbericht

heise Security

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0003

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2024-53704

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-53704

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-53704

EUVD