SonicWall Discloses Multiple Vulnerabilities Including a High Severity Authentication Bypass Flaw

What Happened

On January 7th, SonicWall released a product security advisory detailing several vulnerabilities including a high severity flaw in the SSL-VPN authentication mechanism which could allow a remote attacker to bypass authentication. While this vulnerability is the highlight of the advisory, it comes in alongside three others including another SSL-VPN authentication bypass (CVSS 7.1), a privilege escalation vulnerability (CVSS 7.8), and a server-side request vulnerability (CVSS 6.5).

Additionally, an SSL-VPN MFA Bypass (CVSS 6.5) vulnerability was also disclosed in a separate advisory. This vulnerability is not as high severity as the previously mentioned authentication bypass, but is important to call out due to the heavy reliance on MFA for securing VPN access.

SonicWall states in their advisory that no active exploitation of these vulnerabilities has been reported but that patching immediately is important to prevent exploitation.

What That Means

Administrators managing virtual or physical SonicWall firewalls should patch immediately. Vulnerabilities affecting these products can allow remote attackers to bypass authentication for SSL-VPN services and allow them direct access to underlying networks.

When operated correctly, a VPN can allow a remote employee access to internal company networks and resources. The benefits of this service are plain to see, however; in the hands of a malicious actor, VPNs are a valuable target specifically due to the network access that they can provide. While logged in to a company VPN, malicious actors will typically begin scanning and scoping out the network to determine their level of access and identify potential targets for lateral movement and exploitation. Some threat actors may opt to start with data exfiltration, downloading any and all data that is accessible to them to later be used for extortion or sold to the highest bidder (or both).

Who’s Impacted

The following list has been directly lifted from the SonicWall Advisory page.

How Would I Know and What Should I Do

At this time, SonicWall has not released any indicators of compromise or any details regarding what to look for to confirm if your systems are being targeted.

Without specifics around exploitation, administrators should be on the lookout for unusual behavior in their environment, especially anything related to any unpatched SonicWall firewalls. This includes, but is not limited to: 

• Unusual or unexpected login attempts to the admin portal or SSL-VPN
• Unexpected changes to the configuration of SonicWall devices

If you suspect your SonicWall firewall has been compromised, you should immediately attempt to contain the incident and establish a scope. In some cases, it may be advisable to disconnect the firewall, recover from a known-good backup, and apply the latest patches before bringing it back online. Also, ensure you rotate any administrator or user account passwords local to the compromised device.

Workarounds

Patching is essential to effectively mitigate exposure to these vulnerabilities. However, if you are unable to patch immediately, a workaround may be available. 

If SSL-VPN is not a critical component of regular business operations, temporarily disabling that functionality on your firewall until patches can be applied has been identified as an adequate workaround. Alternatively, refer to the suggestions made by SonicWall in both advisories:

SNWLID-2025-0003

To minimize the potential impact of SSL-VPN vulnerabilities, please ensure that access is limited to trusted sources, or disable SSL-VPN access from the Internet. For more information about disabling firewall SSL-VPN access, see: how-can-i-setup-ssl-vpn.

To minimize the potential impact of an SSH vulnerability, we recommend restricting firewall management to trusted sources or disabling firewall SSH management from Internet access.

For more information about disabling firewall SSH management access, see: how-can-i-restrict-SonicOS-admin-access

SNWLID-2025-0001

To mitigate the SSL-VPN MFA bypass issue in SonicWALL SSL-VPN, modify the LDAP Schema settings to prevent authentication via UPN (User Principal Name). This can be achieved by removing "userPrincipalName" from the "Qualified login name" field in the LDAP configuration.

This configuration can be accessed by navigating to: Device > Users > Settings > Authentication > Configure LDAP > Edit Primary LDAP Server > Schema.2025-01-06 19:21:57

When Will it Be Fixed?

Patches are available now and include the following:

How Blumira Can Help

Blumira’s security team is actively monitoring this issue and exploring methods to detect potential exploitation of these vulnerabilities.

Several detections and reports are available to our customers and may help reveal possible exploitation of these vulnerabilities or post-exploitation activity: