Security experts emphasize that despite the significant reverse-engineering effort required to uncover the vulnerability, the exploit itself is trivial to execute, making immediate patching critical for all affected organizations. Attackers are actively exploiting a critical authentication bypass vulnerability in SonicWall firewalls to gain unauthorized network access. “The released PoC exploit allows an unauthenticated threat actor to bypass MFA, disclose private information, and interrupt running VPN sessions,” Arctic Wolf stated. The vulnerability tracked as CVE-2024-53704, with a critical CVSS score of 9.8, allows remote attackers to hijack active SSL VPN sessions without requiring authentication. Security researchers at Bishop Fox have thoroughly documented how the flaw in SonicWall’s SonicOS allows attackers to bypass the authentication mechanism in the SSL VPN component. On February 14, 2025, cybersecurity company Arctic Wolf reported detecting exploitation attempts “shortly after the PoC was made public,” confirming SonicWall’s concerns about the vulnerability’s exploitation potential. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. “An unprivileged attacker can send a request to the SSL VPN, and as long as at least one VPN user is connected, hijack their session,” researchers explained. “That means the attacker can gain access to anything the victim can reach inside the private network,” Williams emphasized. The vulnerability affects SonicOS versions 7.1.x (up to 7.1.1-7058), 7.1.2-7019, and 8.0.0-8035, used across multiple models of Gen 6 and Gen 7 firewalls and SOHO series devices. Bishop Fox researchers successfully reproduced the vulnerability and released a proof-of-concept exploit approximately one month after patches were available. SonicWall initially disclosed the vulnerability on January 7, 2025, urging customers to upgrade their firewalls’ firmware immediately. CISA has added CVE-2024-53704 to its Known Exploited Vulnerabilities Catalog and requested that organizations patch affected systems before March 11, 2025. For organizations unable to patch immediately, SonicWall recommends limiting access to trusted sources and restricting access from the Internet entirely if not needed. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 03 Apr 2025 14:00:22 +0000