CVE-2024-22394

Published: Feb 8, 2024Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific conditions could allow a remote attacker to bypass authentication. This issue affects only firmware version SonicOS 7.1.1-7040.

Affected (1)

Products: Sonicwall: Sonicos

Sonicwall

1 product

Sonicos

Configuration A

1 vulnerable · 21 platform

Vulnerable Software	Affected Versions
Sonicwall Sonicos	Version 7.1.1-7040

Running on/with	Platform Versions
Sonicwall Nsa 2700	All versions
Sonicwall Nsa 3700	All versions
Sonicwall Nsa 4700	All versions
Sonicwall Nsa 5700	All versions
Sonicwall Nsa 6700	All versions
Sonicwall Nssp 10700	All versions
Sonicwall Nssp 11700	All versions
Sonicwall Nssp 13700	All versions
Sonicwall Nsv 270	All versions
Sonicwall Nsv 470	All versions
Sonicwall Nsv 870	All versions
Sonicwall T2270	All versions
Sonicwall Tz270w	All versions
Sonicwall Tz370	All versions
Sonicwall Tz370w	All versions
Sonicwall Tz470	All versions
Sonicwall Tz470w	All versions
Sonicwall Tz570	All versions
Sonicwall Tz570p	All versions
Sonicwall Tz570w	All versions
Sonicwall Tz670	All versions

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0003

Source: PSIRT@sonicwall.com

Vendor Advisory

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0003

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.