The vulnerability of the SonicWall Analytics analytical service and the SonicWall Global Management System (GMS) global network firewall management system lies in the use of cryptographic algorithms with hard-programmed keys for encryption. This allows attackers to compromise the integrity of the protected information.

🗓️ 26 Jul 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

Hard-coded cryptographic keys in SonicWall Analytics and Global Management System enable attackers to compromise integrity.

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2023-34127	13 Jul 202300:00	–	attackerkb
BDU FSTEC	The vulnerability of the SonicWall Analytics analytical service and the SonicWall Global Management System (GMS) global network firewall system lies in the lack of restrictions on file downloads, which allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	26 Jul 202300:00	–	bdu_fstec
Circl	CVE-2023-34130	13 Jul 202307:42	–	circl
CNNVD	SonicWALL Analytics和GMS 加密问题漏洞	13 Jul 202300:00	–	cnnvd
CVE	CVE-2023-34130	13 Jul 202301:06	–	cve
Cvelist	CVE-2023-34130	13 Jul 202301:06	–	cvelist
EUVD	EUVD-2023-38232	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in Sonicwall	22 Aug 202300:00	–	ncsc
NVD	CVE-2023-34130	13 Jul 202302:15	–	nvd
OSV	CVE-2023-34130	13 Jul 202302:15	–	osv

Vulners

Node

sonicwall sonicwall_global_management_system_(gms)Range<9.3-9330

OR

sonicwall sonicwall_analyticsRange<2.5.2-r9

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-34130
psirt	www.psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010
sonicwall	www.sonicwall.com/support/notices/230710150218060
web	www.web.nvd.nist.gov/view/vuln/detail

26 Jul 2023 00:00Current

7.3High risk

Vulners AI Score7.3

CVSS 37.5

CVSS 27.8

EPSS0.0026

hard coded keys cryptographic keys sonicwall analytics global management system data integrity remote attacker