Lucene search

SonicwallCVE-2024-22395

HistoryFeb 24, 2024 - 12:15 a.m.

CVE-2024-22395

2024-02-2400:15:45

CWE-287

sonicwall

web.nvd.nist.gov

cve-2024-22395

sma100

ssl-vpn

access control

vulnerability

remote attacker

mfa

nvd

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

Confidence

High

EPSS

Percentile

9.0%

JSON

Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a remote authenticated attacker to associate another user’s MFA mobile application.

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "SMA100",
    "vendor": "SonicWall",
    "versions": [
      {
        "status": "affected",
        "version": "10.2.1.10-62sv and earlier versions"
      }
    ]
  }
]

References

psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0001