SonicWall Advises Users to Reset Logins After Config Backup Leak

SonicWall has alerted its customers to reset all login credentials after a recent leak exposed firewall configuration backups, and officials advise organisations to follow three stages—containment, remediation, and monitoring—to minimise risk and restore secure access. According to SonicWall, containment should come first to block further exposure, followed by remediation to reset passwords and shared secrets, and finally monitoring to detect any unauthorised activity.

Administrators are urged to disable or restrict management services over the WAN interface, editing each WAN interface to disable HTTP, HTTPS and SSH management, and, if possible, to limit management access to trusted IP addresses only. They should also turn off SSL VPN and IPsec VPN services for the WAN zone and review inbound rules to prevent attackers from regaining access after a password reset.

After credentials are reset, monitoring is essential, with real-time logging and system event reviews for failed logins, configuration changes, or unusual VPN connections, and alerts configured for repeated authentication failures or new services on the WAN, with monitoring recommended for at least 30 days.