ACSC Warns of Active Exploitation of SonicWall SSL VPN Vulnerability (CVE-2024-40766)

The Australian Cyber Security Centre (ACSC) has warned of active exploitation of CVE-2024-40766, a critical vulnerability in SonicWall SSL VPNs that has been linked to Akira ransomware intrusions against Australian organisations. According to the advisory, an improper access control vulnerability has been identified in the SonicWall SonicOS management access and SSLVPN, potentially leading to unauthorized resource access and, under specific conditions, causing the firewall to crash.

The flaw affects Gen 5, Gen 6 and Gen 7 SonicWall devices running vulnerable SonicOS versions, with exploitation allowing attackers to gain unauthorised access to corporate networks and, in some cases, crash the firewall itself. The ACSC notes threat actors are already taking advantage of the flaw, including the Akira ransomware targeting vulnerable Australian organisations through SonicWall SSL VPNs.

It urges immediate updates, stating that the patch is available for download on mysonicwall[.]com, and provides mitigations such as restricting firewall management access, disabling WAN management from the internet, limiting SSLVPN access, and changing passwords after updating.