peter bassill · operator
$ cve CVE-2024-40766 JSON

CVE-2024-40766 KEV

9.8
CRITICAL · CVSS 3.1 · EPSS 18.4% (pctl 97)

Patch first

On CISA KEV — known exploited in the wild, due 2024-09-30.

Description

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS18.38% — more likely to be exploited than 97% of all CVEs
WeaknessCWE-284
On CISA KEVyes — remediate by 2024-09-30
Public exploitnone known
Published2024-08-23
Last modified2026-09-21

CISA KEV

NameSonicWall SonicOS Improper Access Control Vulnerability
Added2024-09-09
Due2024-09-30
Vendor / productSonicWall / SonicOS
Ransomware useknown

Affected (40)

VendorProduct
sonicwallnsa 2650
sonicwallnsa 2700
sonicwallnsa 3600
sonicwallnsa 3650
sonicwallnsa 3700
sonicwallnsa 4600
sonicwallnsa 4650
sonicwallnsa 4700
sonicwallnsa 5600
sonicwallnsa 5650
sonicwallnsa 5700
sonicwallnsa 6600
sonicwallnsa 6650
sonicwallnsa 6700
sonicwallnssp 10700
sonicwallnssp 12400
sonicwallnssp 12800
sonicwallsm 9200
sonicwallsm 9250
sonicwallsm 9400
sonicwallsm 9450
sonicwallsm 9600
sonicwallsm 9650
sonicwallsm9800
sonicwallsoho
sonicwallsoho 250
sonicwallsoho 250w
sonicwallsohow
sonicwallsonicos
sonicwalltz 300
sonicwalltz 300p
sonicwalltz 300w
sonicwalltz 350
sonicwalltz 350w
sonicwalltz 400
sonicwalltz 400w
sonicwalltz 500
sonicwalltz 500w
sonicwalltz 600
sonicwalltz 600p

References

→ the Explorer  ·  watch your stack  ·  NVD