.webp "Sonicos IPsec VPN Vulnerability Enables Attackers to Cause DoS Condition")
SonicWall has recently made public a critical heap-based buffer overflow vulnerability in its SonicOS IPSec VPN. This flaw, known as CVE-2024-40764, poses a significant risk as it could potentially allow remote attackers without authentication to trigger a Denial of Service (DoS) scenario. With a high severity rating of 7.5 on the Common Vulnerability Scoring System (CVSS) v3, this vulnerability demands immediate attention from affected organizations.
The vulnerability, affecting various versions of SonicWall’s Gen6 and Gen7 platforms, was initially reported on July 17, 2024. SonicWall has taken proactive measures by offering a workaround and is actively developing a patch to rectify this critical issue.
The heap-based buffer overflow vulnerability within the SonicOS IPSec VPN opens up a gateway for unauthenticated remote attackers to exploit the system, potentially leading to a DoS situation. This would not only disrupt services but could also result in significant downtime for organizations affected by this vulnerability.
A wide array of SonicWall products across different versions are impacted by this vulnerability. The list includes various Gen6 NSv models such as NSv10, NSv25, NSv50, NSv100, NSv200, NSv300, NSv400, NSv800, and NSv1600 running on 6.5.4.4-44v-21-2395 and older versions. Additionally, Gen7 models like TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700, NSv 270, NSv 470, and NSv 870 are also affected, running on 7.0.1-5151 and older versions, as well as 7.1.1-7051 and older versions.
To mitigate the potential repercussions of this vulnerability, SonicWall recommends limiting inbound IPSec VPN access to trusted sources or completely disabling IPSec VPN access from Internet sources. This interim solution should be implemented until the official patch is deployed. Organizations are advised to reach out to SonicWall Technical Support for further guidance on restricting or disabling IPSec VPN access.
SonicWall has already released fixed versions for the impacted platforms. These include versions 6.5.4.v-21s-RC2457 for Gen6 NSv models and 7.0.1-5161, 7.1.1-7058, 7.1.2-7019 for Gen7 models. It is imperative for organizations utilizing SonicWall products to take immediate action to address the risks brought about by CVE-2024-40764.
By restricting or disabling IPSec VPN access and promptly applying the necessary patches, businesses can safeguard their systems from potential DoS attacks. It is crucial for organizations to prioritize cybersecurity measures to protect their sensitive data and ensure the continuity of their operations.