The surge in attacks follows the public release of proof-of-concept (PoC) exploit code on February 10, 2025, by researchers at Bishop Fox, amplifying risks for organizations with unpatched devices. Security analysts attribute the rapid weaponization to the vulnerability’s critical impact and the historical targeting of SonicWall devices by ransomware groups like Akira and Fog. A critical authentication bypass vulnerability in SonicWall firewalls, tracked as CVE-2024-53704, is now being actively exploited in the wild, cybersecurity firms warn. By February 12, Arctic Wolf observed exploitation attempts originating from fewer than ten distinct IP addresses, primarily hosted on virtual private servers (VPS). In late 2024, Akira ransomware affiliates leveraged compromised SonicWall VPN accounts to infiltrate networks, often encrypting data within hours of initial access. Successful exploitation bypasses multi-factor authentication (MFA), exposes private network routes, and allows unauthorized access to internal resources. As Arctic Wolf cautions, delays risk “catastrophic network compromise” given the severity of the vulnerability and the agility of ransomware actors. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. CVE-2024-53704, rated 9.3 on the CVSS scale, resides in the SSL VPN authentication mechanism of SonicOS, the operating system powering SonicWall’s Gen 6, Gen 7, and TZ80 firewalls. Arctic Wolf warns that CVE-2024-53704 could similarly serve as a gateway for ransomware deployment, credential theft, or espionage. Attackers can remotely hijack active VPN sessions by sending a crafted session cookie containing a base64-encoded null byte string to the /cgi-bin/sslvpnclient endpoint. As of February 7, over 4,500 internet-exposed SonicWall SSL VPN servers remained unpatched, according to Bishop Fox. SonicWall initially disclosed the flaw on January 7, 2025, urging immediate patching. With active exploitation underway, organizations must prioritize patching to mitigate risks. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. The convergence of public PoC code, high attack feasibility, and SonicWall’s prominence in enterprise networks underscores the urgency.
This Cyber News was published on cybersecuritynews.com. Publication date: Sun, 16 Feb 2025 05:20:08 +0000