UpHeron
All vulnerabilities

Servers and applications

CVE-2024-40766

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 9 Sept 2024.

Severity
Critical 9.8
Published
23 Aug 2024
Last changed
21 Sept 2026
Added to UpHeron
1 Nov 2026
Fixed in
5.9.2.14-13o, 6.5.2.8-2n, 6.5.4.15.116n
Sources
NVD

Affected software

SoftwareAffected versions
SonicWall SonicOSServers and applications · cpe:o:sonicwall:sonicos
  • Every version before 5.9.2.14-13o
  • Every version before 6.5.2.8-2n
  • Every version before 6.5.4.15.116n
  • Every version up to 7.0.1-5035

Known exploited

CISA name
SonicWall SonicOS Improper Access Control Vulnerability
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due for US agencies
30 Sept 2024
Used in ransomware
Yes, known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-40766
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-40766