Veille CVE
CVE-2024-40766
9.8 Critique Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — SonicWall SonicOS Improper Access Control Vulnerability
Ajoutée le 09/09/2024 · Échéance de correction (agences US) : 30/09/2024
Action requise : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 9.3 Critique | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L |
Faiblesses (CWE)
Références
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40766 US Government Resource