CVE-2024-40766

Published: Aug 23, 2024Modified: Jun 17, 2026CISA KEV

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

Affected (4)

Products: Sonicwall: Sonicos

Sonicwall

1 product

Sonicos

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sonicwall Sonicos	Before 5.9.2.14-13o

Running on/with	Platform Versions
Sonicwall Soho	All versions

Configuration B

1 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Sonicwall Sonicos	Before 6.5.2.8-2n

Running on/with	Platform Versions
Sonicwall Nssp 12400	All versions
Sonicwall Nssp 12800	All versions
Sonicwall Sm9800	All versions

Configuration C

1 vulnerable · 29 platform

Vulnerable Software	Affected Versions
Sonicwall Sonicos	Before 6.5.4.15.116n

Running on/with	Platform Versions
Sonicwall Nsa 2650	All versions
Sonicwall Nsa 3600	All versions
Sonicwall Nsa 3650	All versions
Sonicwall Nsa 4600	All versions
Sonicwall Nsa 4650	All versions
Sonicwall Nsa 5600	All versions
Sonicwall Nsa 5650	All versions
Sonicwall Nsa 6600	All versions
Sonicwall Nsa 6650	All versions
Sonicwall Sm 9200	All versions
Sonicwall Sm 9250	All versions
Sonicwall Sm 9400	All versions
Sonicwall Sm 9450	All versions
Sonicwall Sm 9600	All versions
Sonicwall Sm 9650	All versions
Sonicwall Soho 250	All versions
Sonicwall Soho 250w	All versions
Sonicwall Sohow	All versions
Sonicwall Tz 300	All versions
Sonicwall Tz 300p	All versions
Sonicwall Tz 300w	All versions
Sonicwall Tz 350	All versions
Sonicwall Tz 350w	All versions
Sonicwall Tz 400	All versions
Sonicwall Tz 400w	All versions
Sonicwall Tz 500	All versions
Sonicwall Tz 500w	All versions
Sonicwall Tz 600	All versions
Sonicwall Tz 600p	All versions

Configuration D

1 vulnerable · 18 platform

Vulnerable Software	Affected Versions
Sonicwall Sonicos	Up to 7.0.1-5035

Running on/with	Platform Versions
Sonicwall Nsa 2700	All versions
Sonicwall Nsa 3700	All versions
Sonicwall Nsa 4700	All versions
Sonicwall Nsa 5700	All versions
Sonicwall Nsa 6700	All versions
Sonicwall Nssp 10700	All versions
Sonicwall Nssp 11700	All versions
Sonicwall Nssp 13700	All versions
Sonicwall Tz270	All versions
Sonicwall Tz270w	All versions
Sonicwall Tz370	All versions
Sonicwall Tz370w	All versions
Sonicwall Tz470	All versions
Sonicwall Tz470w	All versions
Sonicwall Tz570	All versions
Sonicwall Tz570p	All versions
Sonicwall Tz570w	All versions
Sonicwall Tz670	All versions

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015

Source: PSIRT@sonicwall.com

Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40766

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.