CVE-2020-5148

2021-03-0503:45:14

CWE-287

sonicwall

www.cve.org

sonicwall

sso-agent

netapi

password hash

firewall access control

bypass

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

35.2%

JSON

SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP’s in the network, this client probing method allows a potential attacker to capture the password hash of the privileged user and potentially forces the SSO Agent to authenticate allowing an attacker to bypass firewall access controls.

CNA Affected

[
  {
    "product": "Directory Services Connector",
    "vendor": "SonicWall",
    "versions": [
      {
        "status": "affected",
        "version": "4.1.17 and earlier"
      }
    ]
  }
]

References

psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0003