SonicWall Urges Admins to Patch Exploitable SSLVPN Bug Immediately
SonicWall released a security bulletin on January 7, 2025, warning customers to upgrade their firewall’s SonicOS firmware to patch an authentication bypass vulnerability in SSL VPN and SSH management that SonicWall deemed susceptible to in-the-wild attacks. This vulnerability is being tracked as CVE-2024-53704 and impacts multiple generation six and generation seven firewalls, running 6.5.4.15-117n and older and 7.0.1-5161 and older versions. SonicWall recommends mitigating this vulnerability immediately by upgrading to the latest firmware version. In an email sent to SonicWall customers, the firewall vendor says the patches are available as of yesterday, and all impacted customers should install them immediately to prevent exploitation. Ivanti has not witnessed any active exploitation as of the publishing of the security advisory. Impacted users are recommended to upgrade to the following versions to address the security risk:
Security Officer Comments:
This SonicWall bulletin lists three other medium to high-severity flaws, CVE-2024-40762, CVE-2024-53705, and CVE-2024-53706. This recommendation to update SonicWall SSLVPN instances is published as a flaw in another SSLVPN product, Ivanti Connect Secure, is being actively exploited to install malware on appliances, according to Ivanti’s investigation. The vulnerability carries the moniker CVE-2025-0282 as well as a critical CVSS score of 9.0 and has been exploited as a zero-day. SSL VPNs are frequently used by organizations for secure access to internal networks and applications, especially due to the increase in remote work, emphasizing the need to prioritize prompt patch management for instances of these products.
Suggested Corrections:
Recommendations from SonicWall:
Zero days can be tough to mitigate depending on what type of device or piece of software is susceptible. The time gap between the production, release, and deployment of a patch and vulnerability disclosure is the most critical aspect of zero vulnerabilities or anyone for that matter. An attacker can leverage a vulnerability from when it's known until systems are patched, which is why vulnerabilities must be responsibly disclosed to vendors. Unfortunately, until development teams release a patch or effective mitigation, there is not much companies can do to prevent attackers from leveraging unpatched systems, especially those exposed to the internet - aside from taking them offline entirely. A disconnect can significantly impact business functions which is why those who fill IT Leadership roles must communicate the possible implications, risks, and overall impact to business leaders so decisions can be made that favor all aspects of the business totality. Applying defense-in-depth strategies and zero-trust can significantly assist in preventing the exploitation of zero-days. Still, it may not contain a full-blown attack depending on the severity and type of exploit possible.
Link(s):
https://www.bleepingcomputer.com/news/security/sonicwall-urges-admins-to-patch-exploitable-sslvpn-bug-immediately/