SonicWall Warns Firewall Hardware Bugs Under Attack

Security vendor SonicWall is warning customers to patch its enterprise firewall hardware to thwart an “imminent ransomware campaign using stolen credentials” that’s exploiting security holes in current models and those running legacy firmware. Targeted are the company’s Secure Mobile Access SMA 1...

SonicWall Warns Firewall Hardware Bugs Under Attack

Security vendor SonicWall is warning customers to patch its enterprise secure VPN hardware to thwart an “imminent ransomware campaign using stolen credentials” that’s exploiting security holes in current models and those running legacy firmware. Targeted are the company’s Secure Mobile Access SMA...

SonicWall warns users of “imminent ransomware campaign”

This post has been updated with a statement from SonicWall below SonicWall has issued an urgent security notice warning users of unpatched End-Of-Life EOL SRA & SMA 8.X remote access devices that they have been made aware of an imminent ransomware campaign using stolen credentials. The exploitati...

Ransomware Attacks Targeting Unpatched EOL SonicWall SMA 100 VPN Appliances

Networking equipment maker SonicWall is alerting customers of an "imminent" ransomware campaign targeting its Secure Mobile Access SMA 100 series and Secure Remote Access SRA products running unpatched and end-of-life 8.x firmware. The warning comes more than a month after reports emerged that...

SonicWall SRA/SMA SQL注入漏洞

Sonicwall SRA and Sonicwall SMA are both security protection products for enterprise managed security access from SonicWall USA. SonicWallSRA/SMA suffers from a SQL injection vulnerability that allows a remote, unauthenticated attacker to execute SQL statements to steal sensitive internal account...

Ransomware Risk in Unpatched, EOL SonicWall SRA and SMA 8.x Products

CISA is aware of threat actors actively targeting a known, previously patched, vulnerability in SonicWall Secure Mobile Access SMA 100 series and Secure Remote Access SRA products running unpatched and end-of-life EOL 8.x firmware. Threat actors can exploit this vulnerability to initiate a target...

Stack Overflow Vulnerability in SonicWall TZ350

SonicWall TZ350 is a firewall product. A stack overflow vulnerability exists in SonicWall TZ350, which can be exploited by an attacker to cause a program crash...

Buffer Overflow Vulnerability in SonicWall TZ350

SonicWall TZ350 is a firewall product. A buffer overflow vulnerability exists in SonicWall TZ350, which can be exploited by an attacker to cause a program crash...

SonicWall Switch Buffer Overflow Vulnerability

SonicWall Switch is a network device. A switch. A buffer overflow vulnerability exists in SonicWall Switch versions prior to 1.1.0.0-11s, which can be exploited by remote attackers to access potentially sensitive information or perform a denial of service DoS attack...

Vulnerability fixed in SonicWall network switches

SonicWall has fixed a vulnerability in several network switches. An unauthenticated malicious party could potentially exploit the vulnerability potentially exploit it to cause a denial-of-service cause or read system memory. The vulnerability resides in the way LLDP network traffic is processed...

CVE-2021-20024

Multiple Out-of-Bound read vulnerability in SonicWall Switch when handling LLDP Protocol allows an attacker to cause a system instability or potentially read sensitive information from the memory locations...

Design/Logic Flaw

Multiple Out-of-Bound read vulnerability in SonicWall Switch when handling LLDP Protocol allows an attacker to cause a system instability or potentially read sensitive information from the memory locations...

CVE-2021-20024

Multiple Out-of-Bound read vulnerability in SonicWall Switch when handling LLDP Protocol allows an attacker to cause a system instability or potentially read sensitive information from the memory locations...

CVE-2021-20024

The CVE-2021-20024 issue affects SonicWall Switch devices and is caused by a vulnerability in LLDP protocol handling that leads to an out-of-bounds read in memory. This can result in system instability and potential exposure of memory contents. Public disclosures and related advisories confirm th...

SonicWall Switch LLDP Protocol multiple Out-of-Bound read vulnerability

Multiple Out-of-Bound read vulnerability in SonicWall Switch when handling LLDP Protocol allows an attacker to cause a system instability or potentially read sensitive information from the memory locations. CVE: CVE-2021-20024 Last updated: July 8, 2021, 5:07 p.m...

SonicWall Switch 缓冲区错误漏洞

SonicWall Switch is a network device. A switch. A buffer overflow vulnerability exists in SonicWall Switch versions prior to 1.1.0.0-11s, which can be exploited by remote attackers to access potentially sensitive information or perform a denial of service DoS attack...

SonicWall SonicOS Buffer Overflow (SNWLID-2021-0006)

According to its self-reported version, the remote SonicWall firewall is running a version of SonicOS that is affected by a buffer overflow vulnerability. A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted unauthenticated HTTP request. This can...

CVE-2021-20025: SonicWall Email Security Appliance Backdoor Credential

The virtual, on-premises version of the SonicWall Email Security Appliance ships with an undocumented, static credential, which can be used by an attacker to gain root privileges on the device. This is an instance of CWE-798: Use of Hard-coded Credentials, and has an estimated CVSSv3 score of 9.1...

SonicWall ‘Botches’ October Patch for VPN Bug

UPDATE An October patch for a critical remote code execution RCE bug in a SonicWall VPN appliance turned out to be insufficient. While the patch closed the RCE attack vector, more than 800,000 devices were still vulnerable to an additional memory-leak flaw for months, according to researchers...

SonicWall Left a VPN Flaw Partially Unpatched Amidst 0-Day Attacks

A critical vulnerability in SonicWall VPN appliances that was believed to have been patched last year has been now found to be "botched," with the company leaving a memory leak flaw unaddressed, until now, that could permit a remote attacker to gain access to sensitive information. The shortcomin...