ACSC Warns of Actively Exploited SonicWall Access Control Vulnerability

According to the Australian Cyber Security Centre (ACSC), a critical SonicWall vulnerability is being actively exploited in the wild, impacting a wide range of SonicWall firewall devices. Tracked as CVE-2024-40766, the flaw affects SonicOS management access and SSLVPN functionality across multiple generations, with a CVSS v3.0 score of 9.3.

The improper access control vulnerability allows unauthorized access to system resources, can cause affected firewalls to crash, and can be exploited remotely over the network with no user interaction required. SonicWall classifies it as CWE-284 and notes the vulnerability has scope that extends beyond the vulnerable component itself; attackers can exploit it without authentication, albeit with low attack complexity.

The advisory lists Gen 5, Gen 6, and Gen 7 devices (with specific models and firmware versions) as affected, and urges immediate patching via mysonicwall[.]com as patches are available.